Actor
Who or what is acting?
Authority
What is authority for an autonomous system?
Authority is the bounded permission for an autonomous system to perform a specific action on behalf of a principal, for a defined purpose, under defined constraints.
This is how Hardalion describes the category. It is not presented here as an established universal definition.
Why authority matters
Systems that can act need more than a tool.
AI systems historically produced information for humans to review. Autonomous systems can increasingly perform actions directly.
When a system can act, the relevant question is no longer only whether it can access a tool or a system. The question becomes whether it has legitimate authority for the exact action being attempted.
The question
One action. One grant of authority.
Can this autonomous system perform this action, on behalf of this principal, for this purpose, under its delegated authority, right now?
Principal
On whose behalf?
Action
What is being attempted?
Resource
What is being acted upon?
Purpose
Why is the action being performed?
Authority
What has actually been delegated?
Constraints
What limits apply?
Time
Is that authority valid now?
Identity, access, and authority
Three different questions.
Identity: who is acting? Authentication: can that identity be established? Access: what systems or resources can the actor reach? Authority: what actions is the actor legitimately permitted to perform, on whose behalf, for what purpose, under what constraints?
Identity establishes who is acting. Access determines what systems an actor can reach. Authority determines what the actor may actually do, on whose behalf, for what purpose, under what constraints.
Identity and access controls remain necessary. For autonomous action, they are not sufficient by themselves.
Bounded authority
Autonomy can be broad. Authority should not be.
A procurement agent may have access to a payment system.
That does not mean it should be able to:
- pay any amount
- pay any beneficiary
- act for any purpose
- act indefinitely
- transfer unlimited authority to another system
Delegated authority
What was handed over, and no more.
Organizations and people may delegate limited authority to autonomous systems. An autonomous system may sometimes delegate narrower authority to another system.
Delegated authority should not silently become broader as it moves.
Human authorization
A person is part of the authority model.
Not every action should be fully autonomous.
An organization may permit lower-risk actions while requiring a person to authorize higher-consequence actions. The agent may have sufficient authority for one action and need additional human authority for another.
Outside that authority, the action stops. Human authorization is not a sign that autonomy failed. It is how some actions receive the authority they require.
Authority across systems
The question travels with the action.
As autonomous systems interact with multiple enterprise systems, and eventually with other organizations, authority becomes a portable question.
Who is acting? On whose behalf? What were they entrusted to do? Does that authority still apply to this action?
From digital to physical autonomy
The problem is not limited to software.
As autonomous systems increasingly interact with machines and physical infrastructure, actions may have physical consequences.
The authority problem extends wherever autonomous systems act, including systems whose actions have physical consequences.
Autonomy should never exceed authority.
Hardalion
Infrastructure for that boundary.
Hardalion is building authority infrastructure for autonomous systems, starting with enterprise AI agents performing consequential digital actions.
Nexus is Hardalion’s control plane for building and operating those agents under explicit authority. Gateway brings agents built elsewhere under the same boundary. ADAP is the open Public Draft for expressing bounded delegated authority between autonomous agents.
Questions
Plain answers.
What is AI agent authority?
AI agent authority is the bounded permission for an agent to perform a specific action on behalf of a principal, for a defined purpose, under defined constraints. It is not the same thing as the agent’s identity, and it is not the same thing as the systems the agent can reach.
How is authority different from access?
Access tells you what systems an actor can reach. Authority determines what that actor may actually do with that reach, on whose behalf, for what purpose, under what constraints, right now.
How is authority different from identity?
Identity tells you who is acting. Authority tells you what that actor is permitted to do. Knowing the actor is necessary. It does not, by itself, authorize every action the actor could attempt.
Can an API key prove authority?
An API key can help establish that an actor may reach a system. It does not, by itself, prove authority for every action that system can perform, for every purpose, without limit, and without regard to time.
What is delegated authority?
Delegated authority is a limited permission that a person or organization gives an autonomous system, or that one system gives a narrower permission to another. It should not silently become broader as it moves.
Why do autonomous systems need bounded authority?
Autonomy can be broad. A system with tools and credentials can attempt many actions. Authority should remain specific to the action, the principal, the purpose, and the constraints that apply now.
When should a human authorize an autonomous action?
When the agent’s own authority is sufficient for a lower-consequence action, it may proceed. When the action needs authority the agent does not have, a person can authorize it. Human authorization is part of the authority model.
What happens when an autonomous system exceeds its authority?
The action should not proceed. The attempt, the decision, and the fact that execution did not occur can be recorded.
How can organizations govern consequential autonomous actions?
By defining the authority an autonomous system actually has, requiring a person where that authority is not sufficient, stopping actions outside it, and keeping evidence of the decision and the outcome.
What is Hardalion Nexus?
Nexus is Hardalion’s control plane for building and operating autonomous agents under explicit authority. If Nexus says no, the action does not happen.