Most teams building AI agent systems are operating in what I call YOLO mode: the agent gets a full API key, a system prompt describing its job, and is pointed at the world. No formal definition of what it's allowed to do. No spending limits. No expiration. No revocation mechanism.
That works fine in development. It becomes a serious liability problem in production.
This post is about a structural pattern borrowed from trust law that solves this problem cleanly. It's not a new idea --- humans have been delegating authority to other humans for centuries, and the legal mechanisms they built along the way are directly applicable to AI agents.
The Problem: Agents Act, But Nobody Defined What They're Allowed to Do
Here's the scenario most teams are in right now.
You build a shopping agent. It has your credit card credentials, access to your e-commerce APIs, and instructions to "find the best deal and buy it." It works great in testing. You ship it.
Three weeks later, it's made $4,000 in purchases you didn't intend. Not because it hallucinated --- it did exactly what it was told. But "find the best deal and buy it" turns out to be a very open-ended instruction when the agent has no spending ceiling, no vendor restrictions, and no mechanism to escalate before committing to an action.
Or consider an email agent. It has OAuth access to your inbox, instructions to reply to customer inquiries, and the ability to send on your behalf. There's no restriction on who it can email, no limit on what it can promise, and no way for your team to know after the fact whether an outbound email was agent-initiated or human-written.
Or a code agent. It has write access to your repository, deploy credentials for production, and instructions to "fix bugs and keep the service running." You can probably see where this goes.
None of these are edge cases. They're the default state for most agent deployments right now. According to Gravitee's 2026 State of AI Agent Security report, 81% of teams have moved past the planning phase into active testing or full deployment --- but only 14.4% have full security approval before sending agents to production.
The agents are running. The governance isn't there yet.
What Trust Law Already Figured Out
This is not a new problem. Humans have been delegating authority to other humans --- attorneys, trustees, employees, brokers --- for as long as commerce has existed. The legal mechanisms that evolved to govern that delegation are surprisingly applicable to AI.
The central concept is the power of attorney: a formal document in which a principal (the person granting authority) designates an agent (the attorney-in-fact) to act on their behalf, within defined limits.
A few properties of a well-drafted power of attorney are worth noting:
Scope is explicit. A general power of attorney grants broad authority. A limited (or special) power of attorney restricts the agent to specific transactions --- sell this property, manage these accounts, execute this contract. The scope is written down and enforceable. As Fiduciary Trust International explains, the attorney-in-fact can only perform transactions "outlined in the document."
The agent has fiduciary duty. The attorney-in-fact isn't just allowed to act --- they're legally required to act in the principal's interest, within the defined scope, with reasonable care. Virginia's Uniform Power of Attorney Act specifies that the agent must "act solely within the scope of the authority granted" and cannot act recklessly or in their own interest.
Revocation is a first-class feature. Powers of attorney can be revoked at any time by the principal. A durable power of attorney survives incapacity but terminates at death. Time-limited powers expire automatically. The ability to end the delegation is built into the design from the start.
Authority cannot be arbitrarily sub-delegated. If I give you power of attorney to act on my behalf, you generally cannot hand that authority to a third party unless the document explicitly permits it. This is called the non-delegation principle. (Texas changed its rules in 2017 to allow explicit sub-delegation in some cases --- but the default is no.)
These four principles --- explicit scope, fiduciary duty, revocability, and controlled sub-delegation --- map almost perfectly onto what we need for AI agents.
Mapping Trust Law to AI Agents: Grants and Certificates
At AgenticTrust, we call these delegation artifacts grants. A grant is a verifiable, machine-readable certificate of authority that travels with the agent and defines exactly what it's permitted to do.
Think of it as a power of attorney for a software process.
A grant specifies:
-
Allowed actions --- what the agent can actually do (
purchase_service,send_email,deploy_to_staging) - Constraints --- spending limits, vendor whitelists, time windows, approval thresholds
- Autonomy level --- how independently the agent can act (from observe-only to fully autonomous)
- Validity window --- when the grant starts and expires
- Revocation --- any party with authority can revoke a grant, immediately invalidating it
Here's what a real grant looks like in Agent Authority Vault (AAV):
{
"agent_id": "agent_shopping_01",
"agent_name": "ShopBot",
"agent_framework": "langchain",
"autonomy_level": 3,
"allowed_actions": ["purchase_service", "price_check", "add_to_cart"],
"constraints": {
"max_spend_per_tx": 150,
"max_spend_daily": 500,
"currency": "USD",
"approved_vendors": ["amazon.com", "stripe.com", "shopify.com"],
"require_human_approval_above": 250
},
"validity_end": "2026-06-30T23:59:59Z"
}
This is the structural equivalent of a limited power of attorney. The agent can purchase services, but only from approved vendors, only up to $150 per transaction, only up to $500 per day, and only until June 30th. Any purchase above $250 requires human approval --- a trip wire, not a hard stop.
When the grant is created, AAV issues a certificate --- a signed, verifiable artifact the agent carries. Before taking any action, the agent checks its certificate against the AAV verify endpoint.
What This Looks Like in Practice
The verify call is the runtime enforcement point. It's a simple POST that the agent makes before executing any scoped action:
import requests
# Agent checks its own authority before acting
response = requests.post(
"https://api.agentictrust.app/v1/verify",
headers={
"Authorization": "Bearer aav_live_sk_..."
},
json={
"certificate_id": "cert_abc123",
"agent_id": "agent_shopping_01",
"requested_action": "purchase_service",
"amount": 89.99,
"currency": "USD",
"vendor": "amazon.com",
"description": "API subscription renewal"
}
)
# Possible outcomes:
# { "authorized": true, "result": "authorized", "autonomy_level": 3, ... }
# { "authorized": false, "result": "vendor_not_approved" }
# { "authorized": false, "result": "budget_exceeded" }
# { "authorized": false, "result": "grant_revoked" }
# { "authorized": false, "result": "approval_pending" }
The response is deterministic. The agent either has authority for this specific action at this specific moment, or it doesn't. If it doesn't, the response tells it why --- the vendor isn't whitelisted, the budget is exhausted, the grant has been revoked, or the amount requires human approval.
Notice what this enables that you don't get from a bare API key:
- Auditability --- every verify call is logged with the agent ID, requested action, amount, and outcome.
-
Revocation --- to pull an agent's authority immediately, revoke the grant. Every subsequent verify call returns
grant_revoked. - Scoped failure --- when an agent exceeds its authority, it fails with a reason, not by doing something undefined.
- Framework independence --- the verify call works the same whether the agent runs on LangChain, CrewAI, AutoGen, or a custom stack. Authority is infrastructure, not application logic.
This is the architectural pattern: the agent carries a certificate, checks that certificate before acting, and the verification system enforces the limits defined by whoever issued the grant. Exactly how a lawyer checks their power of attorney before executing a transaction on a client's behalf.
Why This Matters Now
There are three reasons the timing matters, and none of them are hype.
Regulation is arriving. The EU AI Act reaches full enforcement in August 2026. Regulatory frameworks now mandate specific controls for agentic AI systems, including immutable audit trails and documented oversight mechanisms. Legal scholars are already proposing what Jurisconsul calls "agentic law" --- a regulatory field specifically governing autonomous agents that initiate actions in the world. The direction is clear: organizations will need to demonstrate that their agents operated within defined authority, not just that the outputs looked reasonable.
The agent economy is scaling. According to enterprise security research from 2026, the average organization now manages 37 deployed agents. When you have one, ad hoc governance is manageable. When you have 37 --- some from your team, some deployed by individual engineers without central review --- you have an authorization problem at scale. The Hacker News reported in January 2026 that enterprise agents are already functioning as authorization bypass paths: a user with limited permissions asks an agent to retrieve data they couldn't access directly, the agent complies, and the logs attribute the action to the agent rather than the requester.
Governance debt compounds. Every agent you deploy without formal authority definitions is a new form of technical debt --- governance debt. Reconstructing "what was this agent actually authorized to do?" six months later, during an audit or incident response, is orders of magnitude harder than defining it upfront. Beam.ai's 2026 research found that 88% of organizations reported a confirmed or suspected AI agent security incident in the last year. The defining gap: 82% of executives believe their existing policies protect them against unauthorized agent actions, but only 21% have actual visibility into what their agents can access.
The cost of implementing a grant-based authority model upfront is low. The cost of retrofitting it after an incident, or after a regulator asks to see your agent authorization records, is not.
The Principle at the Core
Strip away the API calls and the JSON and the regulatory citations, and the principle is simple.
When you hire a lawyer to close a real estate transaction, you don't hand them your entire financial life and say "use your judgment." You give them a limited power of attorney that specifies exactly what they're authorized to do, for how long, and under what conditions. You retain the ability to revoke it. You expect them to operate within those limits --- and the law requires it.
AI agents are no different, structurally. They're acting on your behalf, with access to real systems, real money, and real data. The fact that they're software doesn't change the delegation problem. It just makes the blast radius larger when the delegation is poorly defined.
The infrastructure to do this properly already exists. Centuries of trust law tells us what the design should look like. What's been missing is a way to encode those principles into the tools developers actually use when building agents.
That's what AAV is.
Try It
The AAV playground at agentauthority.dev/playground has six live demo scenarios you can run right now without signing up. The "Verify an Action" endpoint is where to start --- it's the core of the system. You can see an authorization succeed, a vendor rejection, a budget limit, and a revoked grant all in a few minutes of clicking around.
If you're building agents in LangChain, CrewAI, AutoGen, or a custom framework, grants drop into your existing architecture without requiring you to redesign it. Authority is a layer, not a rewrite.
If you're at the point where you're about to move agents to production and you want a second pair of eyes on your authorization model, I offer free governance reviews for teams building serious agent infrastructure. Not a sales call --- a working session where we look at what your agents are authorized to do, how that authority is defined, and where the gaps are.
We're launching on Show HN on March 31st. The boring-but-critical back-office work for AI agents is just getting started.
Jeff is the founder of AgenticTrust, which builds authority, records, compliance, and reputation infrastructure for AI agents. Agent Authority Vault (AAV) is their delegated authority product.
Top comments (0)