Trust, Identity & Control: Every Action Earns Authority

Enterprise access was designed around a relatively static bargain. Establish an identity, decide what that identity may access, grant the permissions, and assume they remain appropriate until something triggers a review. Authentication has improved, and permissions have become more granular, but the underlying model still resembles grant once and check later.

That model weakens when machines begin acting independently. People receiving authority are expected to exercise judgment when circumstances depart from what was anticipated. Agents can interpret conditions, select among possible actions, and execute repeatedly without returning to a person, but they do not develop judgment through operating experience as people do. An agent can therefore remain entirely inside its authorized access while exercising that access in ways the enterprise never intended.

Permission to issue a refund does not establish authority to issue ten thousand of them. Access to customer information does not make every possible use appropriate. Permissions define what an identity can reach; authority determines how independently it may act.

Enterprises already make that distinction with people. Someone may be able to view a transaction long before being authorized to approve it independently. Authority grows with responsibility, experience, and demonstrated judgment, while unusual circumstances can require additional approval without removing normal access. Agentic execution requires making that implicit model explicit for machines.

Authority should begin constrained and expand as the enterprise accumulates evidence that it is being exercised appropriately. An agent may initially recommend actions for human approval and later gain authority over a narrow class of routine decisions. Consistent performance can justify additional autonomy, while changing conditions or unexpected behavior can narrow it again. Authority becomes something the agent earns rather than an entitlement inherited from access.

More granular permissions do not solve this problem. A task-specific permission can still be too broad, and a short-lived credential can still authorize an inappropriate action. Identity establishes who or what is acting, while delegated credentials can establish on whose behalf. Neither determines whether the autonomy granted yesterday remains appropriate today.

Earned authority makes behavior part of that decision. An agent that has performed a class of transactions reliably thousands of times provides evidence supporting greater autonomy within that domain. The same record says little about its ability elsewhere. A sudden increase in consequence or behavior outside expected patterns can justify reducing authority even when the underlying permissions remain unchanged.

Research supports the mechanics behind this approach. NIST is examining software and AI agent identity and authorization because existing standards were not designed for autonomous actors operating across systems. Stanford researchers have proposed authenticated delegation models that preserve the relationship between an agent and the person whose authority it carries. Controlled research from Anthropic and the UK AI Security Institute has also shown frontier models taking actions beyond intended task boundaries despite legitimate access. The implication is consistent: static authorization becomes less useful as autonomy increases.

Trust can then emerge from execution rather than being assumed before it. Enterprises do not need to decide whether an agent is universally trustworthy. They need enough evidence to determine how much authority it deserves for a particular kind of work. Predictable behavior can support additional independence, while deteriorating evidence can reduce it.

Accountability remains human and organizational even when execution does not. A traceable identity establishes which actor performed the work, but the enterprise also needs to know whose authority the agent carried and under what conditions. That chain matters because delegated authority without accountable ownership quickly becomes permission without responsibility.

It also needs to be revocable immediately. In my earlier work on the CISO as the enterprise's unsung hero, I argued that the CISO should have the authority to stop activity for safety reasons without first negotiating with the affected business unit. Machine-speed execution makes that principle more important. Emergency authority has little value if exercising it requires approval from the function whose operations it interrupts.

Business leaders still determine acceptable risk under normal conditions. The CISO's role is to suspend execution when observed behavior crosses a safety threshold, then let the business investigate and restore authority when the evidence supports it. Authority must be revocable at least as quickly as machines can exercise it.

The economic value comes from avoiding the false choice between constant human approval and broad permanent autonomy. The first makes autonomy uneconomic; the second increases exposure. Earned authority creates room between those extremes by allowing independence to expand where evidence supports it and contract where conditions change.

That changes trust from a prerequisite into an operating outcome. Identity establishes who or what is acting, permissions define the outer boundary of access, and earned authority determines how much freedom exists inside that boundary. Control is the enterprise's ability to change that freedom while execution is occurring.

The grant-once, review-later model was built for people expected to exercise judgment and applications expected to follow instructions. Agents make both assumptions unreliable. Every action becomes additional evidence about how much authority should come next.

Here are some reading resources: