AI agent authorization vs authority
AI agent authorization · Permission vs authority
Authorization is what an AI agent can technically reach, through its accounts, tokens and permissions. Authority is what it is entitled to decide on behalf of the organization. An agent can be perfectly authorized to perform an action it has no authority to take.
Side by side
| Authorization | Authority | |
|---|---|---|
| Question | Can it access this? | May it decide this? |
| Where it lives | Identity system, tokens, roles | Mandate, rules, thresholds |
| Who sets it | Security and IT teams | The business, with the DDAO |
| Typical failure | Excessive or leaked rights | A power nobody wrote down |
| Granularity | Resource or operation | Decision in context, amount included |
Why a valid token is not a mandate
Consider a refund agent that holds the write permission on the payment system. Access control correctly lets it call the refund function for 40 euros and for 40,000 euros, because access control checks the right to call the function, and nothing about the merits of the decision. Only a rule stating who may refund what, up to which amount and in which situation can make the distinction.
The opposite failure is just as common. A written rule that forbids deletion means little if the technical right stays open. In the incident reported by Decrypt in April 2026, the instructions forbade destructive actions while an unscoped token, found in an unrelated file, allowed them. Rules inside the agent are worth writing, and the setting that holds is the one outside it: tokens limited to one environment and a few operations.
Align the two, action by action
Standing permissions grant a right once and for all, while an agent's actions vary one by one. This explains the growing interest in per-action authorization, of which an IETF Internet-Draft gives one technical expression, separating authorization for each action from the agent's identity and permanent capabilities. It remains a working document. The OECD also reports that practitioners find classic identity and access tools poorly suited to agents.
In ACF the principle is simple: permissions never exceed the mandate, and each action that commits the organization is checked against the rules before it takes effect, with one of four outcomes: authorized, adjusted, blocked or escalated to a person. ACF Control carries out this check.
Frequently asked questions
Is OAuth enough to govern an AI agent?
OAuth and similar mechanisms answer the access question, and they are necessary. They say nothing about whether a given decision is acceptable at this amount, for this customer, at this moment. Those limits belong in the mandate and in a control applied before execution.
What is least privilege for an AI agent?
Giving the agent only the rights its task requires, for only as long as needed. An agent that sorts emails needs read access and has no use for the right to delete them.
Where does your organization stand?
ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.
Related terms
Primary sources
Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated .