Delegation by Design

Agentic authority becomes manageable when it is decomposed. Read is permission to retrieve defined data. Write is permission to create or alter records. Communicate is permission to represent the organisation to a person or external system. Decide is permission to select among consequential options. Spend is permission to commit money or commercial terms. Execute is permission to trigger an operational or technical action.

These rights are not a maturity ladder. A low-risk agent may read and write extensively inside a sandbox but never communicate externally. Another may communicate approved status updates but cannot alter the system of record. A procurement agent might prepare a decision while spend authority remains human. The design objective is least authority for the intended outcome.

Every right needs a scope: the identity under which the agent acts; the data, system and transaction class; the maximum value or volume; the permitted time window; the required approval; the evidence retained; and the recovery action. NIST’s 2026 work on software-agent identity and authority highlights why conventional identity and access controls must be adapted when software can act with increasing independence. ²

An authority budget states how much consequential action a system may take before human approval or automatic suspension. It can be expressed through transaction value, customer count, data sensitivity, external reach, irreversibility, cumulative action or time. The budget should shrink as uncertainty, privilege and consequence rise.

The maximum blast radius is the plausible harm before detection and containment. It is shaped by action speed, tool connectivity, permission breadth, monitoring delay and recoverability. A single incorrect draft has a small radius. An agent with access to a customer database, outbound messaging and refund authority can create compounding harm in minutes.

Controls must therefore work at machine speed. Rate and value limits, allow-listed tools, scoped credentials, separation of duties, approval checkpoints, anomaly detection and circuit breakers are more reliable than a policy instruction inside a prompt. Human review should be placed where consequence or ambiguity is highest, not indiscriminately added after every step.

NIST’s GenAI profile covers threat modelling, testing, monitoring, acceptable-use boundaries and incident response. ⁴

The control plane is the operating system that makes AI use visible and governable. It has eight functions: discover, register, classify, test, approve, monitor, respond and retire. The same workflow should cover vendor features, embedded models, employee-built automations and centrally developed agents; otherwise authority migrates to the least visible channel.

Discovery identifies AI-enabled systems and material changes. Registration records purpose, owners, rights, data, dependencies and evidence. Classification determines consequence and control intensity. Testing evaluates task performance, failure modes, security and human interaction in context. Approval grants a defined authority budget, not a permanent licence.

Monitoring compares behaviour, performance and incidents with approved baselines. Response assigns the ability to interrupt, contain, investigate, notify and learn. Retirement revokes credentials, preserves required records and removes dormant integrations. ISO/IEC 42001 places these practices within an AI management system. ⁹

A board should ask for evidence from this system: the population of material agents, rights granted, exceptions, control performance, incidents, authority expansions and retirements. A policy completion percentage is not evidence that delegation is controlled.

Prompt injection is not only an output-quality problem. Instructions can enter through retrieved documents, websites, messages or tool responses and steer a connected system toward unintended behaviour. The more systems and rights an agent can access, the more a language-layer failure can become an operational event. ⁴

Identity ambiguity compounds the problem. Teams need to distinguish the human sponsor, service identity, model, agent configuration and downstream action. Logs must show who authorised the deployment, which identity acted, what context and tools were available, what the system decided, which approvals occurred and what changed as a result.

Evaluation must include adversarial and operational conditions: missing or conflicting data, malicious content, ambiguous requests, tool failure, approval timeout, repeated actions, privilege escalation and recovery. NIST’s 2026 synthesis of agent-security submissions reinforces the need to treat identity, authorisation, tool access and connected-system effects as system concerns. A high task-success score is insufficient if rare failures are irreversible or invisible. ⁸

Incidents should be treated as a learning system. The OECD’s common reporting framework proposes shared criteria for describing AI incidents across sectors and jurisdictions. Internally, near misses are equally valuable because they reveal control weakness before harm crosses a reporting threshold. ⁷

First, define which decisions and actions remain non-delegable. Second, approve the rights taxonomy and authority-budget principles. Third, set materiality thresholds for board and executive visibility. Fourth, require a single accountable business owner for every material agentic workflow.

Fifth, approve the minimum evidence for expanding authority: task performance, control effectiveness, monitoring, identity, recovery and incident readiness. Sixth, define who can suspend an agent and under what conditions. Seventh, agree how customers, workers, regulators and partners will be informed when an agent materially represents or affects them.

These are operating-model decisions, not merely technical standards. They determine how responsibility flows when actions are produced by a chain of people, models, tools and systems. Management can design the controls; the board must ensure authority and accountability remain aligned.

An assurance pack is the minimum evidence needed to reconstruct why an agent was allowed to act. It records purpose, owner, affected people, service identity, model and tool chain, data access, six rights, authority budget, test evidence, approvals, monitoring, incidents and recovery procedures.

The pack should distinguish capability evidence from control evidence. Task success shows whether the system can complete representative work. Control evidence shows whether it stays inside authority, rejects or escalates unsafe conditions, produces reconstructable logs and can be interrupted and recovered.

Large-scale red-teaming evidence demonstrates why agent evaluation must include malicious instructions embedded in external data. A system may perform well on benign tasks while remaining vulnerable to indirect prompt injection once connected to email, websites, repositories or tools. ¹⁰

The evidence should travel with the configuration. Expanding a tool right, raising a spend limit, adding a data source or changing the model creates a new assurance question. Versioned evidence prevents an old approval from silently governing a materially different system.

A read-only research assistant using public data does not require the same evidence as a system that sends customer communications, changes records or spends money. Applying the maximum control set everywhere can push use into less visible channels and waste scarce assurance capacity.

Classification should combine consequence, reversibility, detectability, reach and novelty. Low-consequence and reversible use can move quickly with logging and clear boundaries. High-consequence, hard-to-detect or irreversible action requires stronger testing, human approval and recovery evidence.

Proportionality is not permissiveness. It is the discipline of matching evidence and authority to consequence, then increasing control as rights or blast radius expand.

NIST’s preliminary Cyber AI Profile adapts cybersecurity practices to the AI system and its context. It is guidance in development, not a universal deployment checklist. ¹¹

In the first 30 days, identify material agentic and tool-connected AI use. Map the six rights, service identities, data access, approvals and plausible blast radius. Suspend or narrow any use case whose authority cannot be reconstructed.

By day 60, define authority budgets, classification criteria and minimum evidence. Test one material workflow under adverse conditions, including indirect prompt injection, tool failure, repeated action, approval failure and emergency suspension. Confirm that logs support forensic reconstruction.

By day 90, bring the board a delegation register: material systems, owners, rights, authority limits, evidence status, incidents and unresolved exceptions. Expand authority for one use case that meets the standard, constrain one that does not, and exercise the organisation’s ability to interrupt and recover.