When an agent acts for you

Before it runs, an agent declares, in signed, machine-readable form, what it is deployed to do. That declared intent is translated into reviewed, enforceable action policies, and every consequential action is checked against them. Anything outside them stops.

• A signed statement of purpose and scope, registered before the agent goes live.
• Each action is validated against those policies the instant before it executes.
• The system watches for drift: an agent slowly doing things its purpose never covered.

Evidence to keep: the signed intent declaration, each boundary check decision, and the drift reports.

Every commitment an agent makes traces to an accountable organizational authority and, where required, an authorized human decision: who or what delegated it, the scope, the expiry. Nothing is self-granted.

• Commitments are checked against the authorizing person's real limits, in money, quantity and scope, before they happen.
• High-stakes actions hit a hard gate the agent cannot self-approve or wait out.
• The human's approval is bound to the exact action, same amount, same recipient, same parameters, so approval for one thing cannot become another.
• Where conflicts or material risk exist, approval must satisfy defined independence and segregation-of-duties rules.
• Delegated authority is revocable on the spot, not merely at expiry: a role change, a compromise or a policy change pulls it back, and revocation reaches every grant derived from it.
• Authority may pass through chains of agents. Each hop may only reduce or narrow the authority it inherits; it cannot create new authority. Chain depth is bounded, and the full chain from principal to acting agent is provable.
• The approved action is the executed action: approvals expire quickly, replays are rejected, and the resulting commitment, counterparty response and final state are reconciled against what was approved.

Evidence to keep: the delegation record behind every commitment, each limit evaluation, the approval bound to the exact action it authorized, revocation events and where they propagated, the complete delegation chain, approval expiry and replay decisions, and the execution receipt reconciled against the approved action.

The rules an agent works under are written down, versioned and machine-readable, rather than knowledge that lives in someone's head.

• Applicable obligations from real contracts are identified, reviewed and translated into enforceable constraints where feasible.
• Conflicting rules are detected before they reach the agent.
• Every data access is evaluated against the policy attached to that data, before it is granted.

Evidence to keep: the versioned policy register, the obligations extracted from each contract, and every policy decision at the moment of access.

An agent that can buy, sign or promise operates inside hard boundaries set by humans before it ever engages.

• A firm ceiling it cannot exceed: a hard block, never a soft warning.
• A review gate that holds execution until the human checks are complete.
• A negotiation envelope, agreed in advance, that it cannot step outside of.
• Limits that are cumulative as well as per action: totals per session, per counterparty and per period, aggregated across every agent drawing on the same authority, so a hundred small actions cannot do what one large action could not.
• Capacity is reserved atomically before execution, so parallel agents cannot each consume the same remaining authority.

Evidence to keep: every attempt against a ceiling, every hold at a review gate, the negotiation envelope each engagement ran under, and the running cumulative picture: reserved and completed commitments, totals per counterparty and period, across every agent sharing the authority.

Authority is watched continuously, not granted once and forgotten: a live view of what every agent is allowed to do, and what it is actually doing.

• A running ledger of each agent's commitment authority.
• Drift detection against the declared purpose and policies.
• A defined response path the moment something crosses a line.

Evidence to keep: the authority ledger over time, each drift alert, and what was done about it.

Every authority decision leaves a tamper-evident trail, and the whole picture rolls up into one signed record a board or an auditor can verify.

• A tamper-evident, access-controlled and independently verifiable record of approvals, commitments and overrides.
• A counterparty-facing proof of authority: the party on the other side of a commitment can verify the agent was authorized for it, without being exposed to internal policy.
• Reporting a board and senior leaders can rely on.
• A signed attestation backed by independently verifiable control evidence.

Evidence to keep: this layer is itself the evidence, the tamper-evident trail and the signed attestation that rolls it up.

In the July 2026 evaluation incidents, the only thing between a capable model and real victims was an instruction in its prompt. It did not hold. A limit an agent can talk itself past is a wish, not a control. That is why the delegation and commitment layers demand hard gates enforced outside the agent.

A human approves one thing; by execution time the amount, the recipient or the parameters have changed. Without binding the approval to the exact action, sign-off becomes a blank check. This is a recurring gap in the deployments we have reviewed, although that observation is not a systematic industry measurement.

Agents accumulate scopes the way old service accounts accumulate permissions: quietly. Without a live ledger and drift detection, the honest answer to "what can this agent commit us to today?" is "we would have to check." By then it is an incident question, not a governance one.