Just Because an AI Agent Can Do Something Doesn't Mean It Should Be Allowed to.

I've been thinking about a distinction that seems increasingly important as AI agents become more capable.

Capability is not authorization.

An AI coding agent might technically be able to:

• Delete a database.
• Modify production infrastructure.
• Change an authentication flow.
• Deploy an application.
• Rotate credentials.
• Merge a pull request.
• Change a security policy.

But technical capability doesn't mean the agent should be allowed to perform those actions.

We don't normally design security systems this way.

A human engineer may have access to a production environment.

That doesn't mean every action they can technically execute is automatically authorized.

There are policies.

Permissions.

Approvals.

Audit trails.

Separation of duties.

So why should AI agents be different?

This becomes particularly interesting when an AI agent moves from generating code to actually executing changes.

The old model was:

Human → AI → Code

The emerging model looks more like:

Human
   ↓
AI Agent
   ↓
Tools
   ↓
Infrastructure

And that creates a new control problem.

The AI may decide:

"I need to modify this production configuration."

But the system should be able to independently determine:

"Is this agent authorized to perform this specific action under the current policy?"

That's a fundamentally different architecture.

The model should reason.

The control plane should authorize.

The runtime should execute.

The audit system should record what happened.

This separation is becoming one of the principles I'm exploring in NAEOS.

       AI Agent
           |
           | proposed action
           ↓
    +---------------+
    | Policy Engine |
    +-------+-------+
            |
      Allow / Deny /
     Require Approval
            |
            ↓
         Runtime
            |
            ↓
       Audit Evidence

The important part is that the AI doesn't get to decide its own authority.

Its reasoning can propose an action.

But authorization should be deterministic and external to the model.

I think this distinction will become increasingly important as we move from AI-assisted development toward autonomous engineering.

What actions should an AI agent never be able to authorize for itself?