Permission Is Not Authority.
Three decisions requiring attention this month.
The first two issues dealt with dates and ownership. This one deals with the line between capability and authority. September's cycle showed that agents inherit access, appear through employee tooling and licences, and often have no named owner. The next board question is not how many exist. It is what they are allowed to decide.
A permission is technical. Authority is organisational. Confusing the two is how a correctly configured agent becomes an unauthorised decision-maker without breaking a single access rule.
Define the decision boundary before you expand the agent estate.
An agent can be technically permitted to perform an action without being organisationally authorised to make the decision behind it. Access controls answer whether the tool can do something. Governance has to answer whether it should decide to do it.
For each material agent, write three lines: what it may decide alone, what requires human confirmation, and what it must never decide. If the boundary needs a committee paper to explain it, it is not an operating boundary.
Separate inherited permissions from delegated authority.
September showed why inherited access matters. The next layer is more specific. A claims handler may be allowed to issue a goodwill payment. That does not automatically mean an agent acting on the handler's credentials has been delegated the judgement to issue one.
Review the highest-impact agent permissions against the human role they came from. Mark each permission as capability only, delegated decision right, or prohibited delegation. The gaps are not identity gaps. They are authority gaps.
Install the reopening trigger before the agent changes.
An approval is only valid for the scope that was approved. Agents change through prompts, tools, connectors, model swaps, workflow edits and vendor releases. The decision boundary therefore needs a reopening rule.
The minimum trigger is simple: if an agent gains a new data source, external action, financial authority, model, tool or customer-facing channel, the approval reopens. A governance gate that never reopens is a one-time ceremony around a moving system.
What changes when capability outruns authority.
Permission becomes mandate
Identity systems correctly grant access. Workflow platforms correctly expose actions. The failure appears when technical capability is read as permission to exercise judgement. The agent can refund, approve, publish or contact because the person could. Nobody separately decided that the judgement itself was delegable.
Authority follows the role instead of the decision
Employee-built agents inherit role access in full. The higher the builder sits, the larger the silent delegation. A regional manager's agent can acquire a regional manager's reach without acquiring the conditions, experience or accountability that made the human authority defensible.
The boundary moves when tools are chained
A drafting assistant looks low risk until it can query a customer file, write to a case system and send externally. Each connector may be individually approved. The chain creates a new decision capability that no single approval described.
Human in the loop becomes human near the loop
A review step only works if the reviewer knows what they are deciding and has time and authority to stop it. A human asked to click approve on hundreds of agent actions is not a control. It is a latency layer with a name attached.
Stop rights exist below the authority that needs them
September asked who can stop the agent. October asks whether that person can stop the business outcome. If the technical stop is owned by engineering but the customer decision is owned elsewhere, the control chain can still fail cleanly.
Fifty-seven days is now an engineering horizon.
The September radar established the fixed dates. By 6 October, the 2 December transition is 57 days away. That is no longer a programme horizon. It is a delivery horizon.
| Date | Position | Time |
|---|---|---|
| 2 Aug 2026 | Article 50 transparency obligations are live | In force |
| 11 Sep 2026 | Cyber Resilience Act reporting obligations, as carried in the September regulatory cycle | Live |
| 12 Sep 2026 | EU Data Act data-by-design obligations for newly connected products, as carried in the September regulatory cycle | Live |
| 2 Dec 2026 | Article 50(2) marking and detection transition ends for qualifying pre-2-August systems | 57 days |
| 2 Dec 2026 | New Article 5 prohibitions reach the end of the transitional period | 57 days |
| 2 Aug 2027 | Operational national AI sandbox deadline | 300 days |
| 2 Dec 2027 | Annex III standalone high-risk systems | 422 days |
The refund agent did exactly what its permissions allowed.
A customer-service team gave an agent access to the same case-management functions held by senior handlers. The agent drafted responses, updated records and, where a workflow condition was met, issued goodwill credits within the handler limit. The system behaved as configured. The problem surfaced when Internal Audit asked for the decision that delegated the handlers' settlement authority to the agent. There was no decision. The access control record was complete. The authority record did not exist.
The control failure was not excessive access. It was undocumented delegation.
The same boundary appears differently by sector.
| Sector | Decision implication |
|---|---|
| Financial services | The decision boundary matters most where an agent can change a customer outcome, move money, alter a limit or close an alert. Map authority by decision type, not by platform. |
| Insurance | Claims agents expose the distinction cleanly. Access to claims data is not authority to settle, reserve, decline or communicate a regulated outcome. |
| Pharma and medtech | Scientific and quality workflows can accumulate tool chains quickly. The relevant question is where recommendation becomes release, sign-off, submission or patient-facing action. |
| Public sector | A citizen-facing agent can carry legitimate system access and still lack a defensible mandate to make or communicate a public decision without review. |
Six questions for the next committee.
- Which actions can our largest agent take today that nobody explicitly delegated to it?
- Where are we using a person's access as evidence that the agent has authority to exercise the person's judgement?
- What change to an agent automatically reopens its approval?
- Which agent can create a customer, financial or regulatory outcome without a human decision at the point of action?
- When a human reviews an agent decision, what exactly are they authorised and expected to challenge?
- If we stopped the agent technically, who decides what happens to the business process next?
| Action | Test of completion | Owner |
|---|---|---|
| Write one decision boundary | For the highest-impact agent, record what it may decide, what requires confirmation and what is prohibited | CIO with business owner |
| Map permissions to authority | Review the top ten inherited permissions and mark whether each decision right was explicitly delegated | CRO with IAM |
| Add reopening triggers | New data, new tool, new model, new external action, new financial authority, new customer channel | CIO |
| Test the human review | Sample one high-volume workflow and measure whether the reviewer can meaningfully challenge rather than rubber-stamp | CAE or 2LOD |
| Close carried positions | Classification rule and third-party register each receive a named owner and date | CRO |
08 - Decision dashboard
Sector view: financial services. Scores are the editorial position for this issue, not a firm assessment.
Down 2 from the September close. Visibility improved, but authority is still implicit in too many workflows.
Pick one material agent and write its decision boundary in three lines. If management cannot agree the three lines, the agent is already ahead of the governance.
This issue continues the evidence base established in Issue 02 and the September cycle: Gartner, Six Steps to Manage AI Agent Sprawl, 28 April 2026; Cloud Security Alliance, 21 April 2026; Microsoft Security Blog, 10 February 2026; Nokod Security, 27 April 2026; IBM CEO Study 2026; Logicalis CIO Report 2026; KPMG Global AI Pulse Q2 2026; CISA, NSA and Five Eyes partners, Careful Adoption of Agentic AI Services, 30 April 2026; Regulation (EU) 2026/1744; European Commission Article 50 materials; the September Decision Signals, Board Case Study and Regulatory Radar. Incident analysis is an anonymised composite from advisory practice. Dashboard scores are editorial positions, not a firm-level assessment. Third-party figures are reported as published and have not been independently verified.
Decision Signals, 13 October. Board Case Study, 20 October. Regulatory Radar, 27 October.