The authority is the account

When an autonomous agent does something you did not expect, the first question is never really what it did. You can see what it did; the damage is right there. The question that decides everything is whether it was allowed to. And that question, in most agentic deployments today, has no clean answer — because the agent was handed a broad credential and a goal and left to figure out the means, so nearly anything it did falls inside the letter of its permissions and nothing it did was specifically authorized. The act is neither sanctioned nor forbidden. It is merely possible. And an act that was merely possible has no author. It has an operator who will say the agent went off-script, and an agent that cannot be asked, and a permission set so wide it consented to everything and therefore to nothing.

This is why authority is not a security detail at the frontier. It is the accountability primitive — the thing that makes an action attributable to a decision a human actually made. In the model era we could locate the responsible human easily: a person read the score and acted, and the act was theirs. When the agent acts on its own, that person is gone from the moment of action, and the only remaining trace of human intent is the authority the agent was operating under. If that authority is a broad standing credential, it records no intent at all — it says the agent could do a great many things, which is not the same as saying anyone decided it should do this one. The scope of the grant is the last place a human decision is written down. Make it wide and you have erased the decision.

So the discipline that security people call least privilege turns out to be an accountability discipline wearing a security name. Task-scoped, just-in-time, narrowly bounded authority — an agent granted exactly the power its current task requires, for the duration of that task, and no more — is not primarily about shrinking the blast radius, though it does that. It is about making every action the agent takes fall into one of two clean categories: inside the grant, and therefore authored by whoever scoped the grant for this task, or outside the grant, and therefore blocked and flagged as an attempt to exceed authority. Both are accountable. What is not accountable is the vast grey middle a broad credential creates, where the agent acts within its permissions but outside anyone's intent, and no one can say whether the act was authorized because the authority was never specific enough to answer.

A broad credential consents to everything and authors nothing. Narrow the authority and you are not just reducing risk — you are restoring the record of who decided what.

Why the grant has to be recorded, not just enforced

Enforcing narrow authority is half the job; recording it is the other half, and the half that is usually skipped. It is not enough that the agent was constrained at runtime. When the action is contested later, you have to be able to show what the constraint was at the instant of the act — the exact scope in force, who set it, for what task, and when it was granted. Authority that lived only in a runtime check and was never written into the action's record leaves the same hole as no authority at all: the agent did something, and you can no longer prove what it was permitted to do when it did it. The grant has to be part of the account of the action, frozen alongside the inputs and the outcome, because "the agent was authorized" is a claim, and a claim without the recorded grant behind it is just the operator's word.

This is where the standards work is now pointing, and it is worth naming plainly because it confirms the shape of the problem. The security community's current catalogue of agentic risks puts identity abuse, privilege compromise, and the misuse of excessive permissions near the top — the recognition that agents are routinely deployed with far more authority than any single task needs, and that this over-grant is the soft underbelly of the whole architecture. And the standards bodies now taking up AI-agent identity have named the root cause exactly: agents are commonly treated as generic service accounts, with no dedicated identity, authorization, or accountability controls of their own. A generic service account is the purest form of the authorless action. It is a credential that belongs to no task and answers for nothing.

Scope is where intent survives the automation

Step back and the principle is older than agents and older than software. Authority has always been how institutions convert a person's intent into an act that can be traced back to them. A power of attorney is narrow on purpose; a purchase approval names an amount and a purpose; a warrant specifies what may be searched and where. The narrowness is not bureaucratic caution. It is the mechanism by which the act stays tied to the decision that authorized it, so that when the act is questioned, there is a specific grant to point to and a specific person who signed it. Broad, standing, purpose-free authority has always been the thing institutions fear most, precisely because it severs that tie — it lets an agent act while leaving no one clearly answerable.

Autonomous software makes this ancient concern urgent in a new way, because the agent will act, quickly and many times, in the gap the broad grant leaves open. The fix is not to slow the agent or to put a human back in front of every act — that surrenders the point of autonomy. The fix is to make the authority itself carry the intent: scope each grant to the task, issue it at the moment the task begins, bind it to the specific action record, and let it expire. Then every act the agent takes is measured against a grant that some human shaped for this purpose, and the account of the act includes the account of its permission. The agent still acts alone. But it acts inside a decision a person made, and that decision is written down where the act can be checked against it.

Get this wrong — deploy the agent on a broad key and a vague goal — and you have built a system that can act with great consequence and answer for none of it, because you removed the human from the moment of action without leaving anything in their place. Get it right and the authority becomes the account: a small, recorded, task-shaped grant that says, for every act, this was permitted, by this decision, for this purpose, within these bounds. That is not the security team's problem to solve after the fact. It is the first accountability question of the agentic era, and it is decided the moment you choose how much power to hand the agent. Hand it exactly enough. Write down what enough was. The rest of the account depends on it.

— Dispatches · The Frontier · Summit Cognitive

---