The agent that outlived its task

We spend most of our attention on how authority begins. Who signs the grant, how narrow the scope, whether the permission is least-privilege and just-in-time — these are the questions a careful team asks before it lets an agent touch anything that matters. They are the right questions. But a grant is not a point; it is an interval. It has a beginning we scrutinize and an ending we rarely think about at all. And the ending is where the accountability quietly fails, because authority, unlike a person, does not know when its work is over. It keeps whatever it was given until something takes it back, and in most systems nothing does.

Consider the ordinary shape of the problem. An agent is dispatched to do a bounded thing — reconcile a set of records, draft and send a batch of messages, resolve a support queue. To do it, the agent is handed real permissions: a credential, a token, a scope over some system that can be changed. The task completes. And then the agent is still there. Its process is still running, or its credential is still live, or its standing instruction to watch a queue never got an end date. The work that justified the authority is finished, but the authority is not. It sits open, attached to nobody's current intention, waiting for an input that will make it act again.

This is not a story about a rogue agent or an exotic failure. It is the default. The mundane outcome of granting authority for a task and never arranging for it to end is that the authority outlives the task — and an agent holding live permissions after its purpose is gone is not idle. It is armed. The next event that reaches it, whether a stray message, a retried job, or a prompt that should have gone nowhere, meets a system that can still act and no longer has a reason to.

Authority that outlives its purpose

The reason this matters is not mainly about attack surface, though it is that too. It is about answerability. The whole case for scoping an agent's authority tightly is that a narrow, recorded grant gives an action an author — you can say, of any given act, on whose authority and for what purpose it was taken. That is the argument I have made before: the authority is the account. But an author's authority is bound to a purpose, and when the purpose is gone the authorship goes hollow. The grant still exists in the system; the reason for it no longer exists anywhere. What you are left with is authority without a current mandate — an action the machine can justify by pointing to a permission, and no living person can justify by pointing to a need.

Ask the accountability question of such an act and you get an unsettling answer. On whose authority? A grant issued for a task that ended last week. For what purpose? A purpose that has already been served. The permission is real, the scope checks out, the record even shows a clean chain from the original decision — and yet nobody is currently authorizing anything. The mandate expired, and no one revoked the grant that carried it, so the grant kept speaking on behalf of a purpose that had stopped existing. That gap, between a permission that persists and a purpose that has lapsed, is the most under-governed part of the whole agentic lifecycle.

An agent still acting after its task is done is not finishing the job; it is exercising an authority whose reason has already ended.

A grant is bound to a task and a time

The correction begins with what we write down. If the account of an agent's authority records only the scope — what it may touch, how far it may reach — then the record cannot tell you whether an action falls inside a living mandate or a dead one. Scope answers what and how much. It does not answer until when, and until when is exactly the fact you need when an agent acts a week after its task closed. A grant, to be accountable, has to be recorded as three things and not two: the authority, the purpose that justifies it, and the lifetime over which that purpose holds.

Tie those together and the record starts doing real work. An action arrives; you can check it not only against the scope but against the clock and the task. Was this act taken while the grant that permits it was still bound to a live purpose? If yes, it has a defensible author. If no, the record itself flags it: this was authority exercised past its mandate, a permission still technically held but no longer attached to any reason for holding it. The point of binding a grant to its task and its lifetime is that the record can then distinguish an agent doing its job from an agent exercising leftover power — and without that binding, the two are indistinguishable, because a stale permission looks exactly like a valid one until someone traces it back to a purpose and finds none.

This is the same discipline the model era already learned in a different register. A model is not authorized forever by the fact that it once passed evaluation; the world it learned drifts, and a responsible deployment decides in advance when the model must be re-examined. A grant is no different. It is issued against a state of affairs — a task that needs doing — and when that state of affairs passes, the grant should not simply persist on inertia. Like a model, a grant needs an expiry: a point at which it stops being valid unless someone, on the record, decides again that it should continue.

Expire the authority with the task

So the lifecycle discipline is plain to state and unglamorous to practice: authority ends when the task ends. The default is not a standing grant that someone eventually remembers to revoke; the default is a grant scoped in time as well as scope, that expires when the work it was issued for completes, and that has to be renewed by an affirmative act if the work continues. Revocation should not be the exception you perform to close authority. Expiry should be the rule, and continuation the thing you have to justify.

Standing authority — an agent that legitimately watches a queue, or holds a credential across many tasks — is not thereby forbidden. It is made into what it should always have been: a deliberate exception, named, owned, and re-justified on the record, rather than an accident that happens when nobody arranged for a grant to end. There is a categorical difference between an agent that holds long-lived authority because someone accountable decided it should and wrote down why, and an agent that holds it because the task finished and the permission was simply never taken away. The first is a governed standing grant. The second is an open mandate nobody remembers making — and when it acts, it acts as a decision nobody is currently authorizing.

The frontier does not change what accountability asks; it changes when the asking has to happen. A human decision-maker feels the end of a task — the work is done, the attention moves on, the authority is not exercised again because there is no one there to exercise it. An autonomous agent feels nothing. It holds what it was given until the system takes it back. So the obligation moves into the system's design: to expire authority with the task, to record the lifetime alongside the scope, and to treat any action past that lifetime as what it is — not the tail end of a job well done, but power with no present warrant. Grant authority as we already know how to. Then be as careful about when it ends as we were about how it began.

— Dispatches · Summit Cognitive