AI Agents Need Proof of Authorization, Not Just Permission

An activity log shows what an agent did. A chat approval may not show exactly what was authorized. Real oversight requires evidence that the two match.

An AI agent can act entirely within its technical access rights and still do something nobody approved. Those rights establish what its tools can reach. A human approval can be narrower: these records, this version, within these limits. The test is not merely whether the agent could perform an operation, but whether the action that occurred matched the decision a person actually made.

Recent articles here have asked whether people can stop agents, when agents should escalate and how institutions retain command. Those safeguards matter. My question begins when approval is granted: can a later reviewer prove that the action taken was the one a person authorized? A chat message saying “approved” may identify neither the exact dataset nor the operation eventually performed.

Consider a hypothetical business migrating customer records to a new platform. A manager approves correcting mailing addresses in 40 records. The agent, which has broader edit access, also changes customer status fields to make the import run smoothly, quietly marking some accounts inactive. Every update succeeds. Every update is within the agent’s permissions. Only the address changes were authorized.

My implementation work taught me that a conversation is a fragile place to store authority. In the AI operating system I built to run my firm, several AI models and connected applications use shared authoritative records. Each consequential approval links to a version-specific task record, and task receipts capture what was done. That creates a traceable decision, but a receipt written by an agent is not independent evidence of what another system executed. The next safeguard is a verifiable match.

That requires two linked records. Before an action, an authorization record names who approved it and in what role, the action allowed, the exact dataset or document version, the systems or recipients affected, and any limits on amount or timing. Afterward, an execution receipt records what was actually done, which records changed, where data went and when, with a reference to the authorization. The receipt should come from the system that carried out the action, not from the agent describing its own work.

Payment authorization offers a useful precedent for precise scope. The Internet Engineering Task Force’s Rich Authorization Requests standard supports detailed grants such as a payment’s amount, recipient and permitted operations, so participating systems can enforce the granted bounds. It does not itself produce an independent receipt proving what was executed. AI agents that edit records, send messages or delete files need both. A downstream system should check each proposed action against the recorded approval and require renewed human consent if the dataset, version, destination or amount differs. In the migration example, the status changes would be refused, not discovered later.

Existing guidance points the same way. OWASP’s guidance on excessive agency advises enforcing authorization in downstream systems rather than leaving that decision to the language model. It notes that logging can limit damage without preventing it. The US National Institute of Standards and Technology’s voluntary AI Risk Management Framework identifies documented human oversight processes as an outcome (MAP 3.5). NIST’s agent identity and authorization project has since progressed from consultation to implementation planning. None prescribes this exact two-record design. It is one way to make oversight testable.

Proof has limits. A matching receipt cannot show that the approver understood the risk or had lawful grounds to decide. Proportion matters too. For a low-risk workflow, an approval ID, the scoped action and the resulting transaction ID may be enough. Actions involving payments, employment or sensitive health data warrant stronger independent checks and longer retention.

Pick one consequential action an AI agent already performs and hand its records to someone who was not in the chat. Can they tell who permitted it, exactly what was permitted, what happened and whether the two match? If not, the organization has evidence that automation occurred. It does not yet have proof of authorization.