01 / The missing grantAn instruction can sound authorised while granting nothing

A servicing agent is told to “resolve routine cases within policy”. It can read customer records, request documents, alter a follow-up date and send messages. The policy owner believes operations set the limits. Operations believes technology encoded them. Technology points to the system prompt. Nobody can state which principal granted which acts, for which population, for how long, under which evidence, or how to cancel work already in flight. The agent is active, yet the organisation has no inspectable act of delegation.

That condition is not peculiar to software. Organisations often delegate to people through job titles, precedent, local custom and shared access. Digital agents expose the weakness because they can act quickly, repeatedly and across systems without the social friction that used to slow an ambiguous grant. A role label such as “case manager” describes a place in an organisation. It does not prove the occupant may waive a condition, alter a customer status, commit money or speak for the institution. A credential proves an identity presented to a system. It does not explain why the holder is allowed to use a resource for this purpose.

This article defines delegation as an accountable principal granting a verified role the bounded authority and resources to make a specified commitment under observable conditions, while retaining the practical ability to challenge, suspend, revoke and remediate. The principal remains accountable. The delegate, whether a person or a digital agent, does not acquire institutional purpose simply because it receives a task. The grant must connect organisational meaning to operating enforcement.

02 / The strong rivalCase-by-case approval is right at the boundary, not everywhere

The strongest rival says that consequential actions should always wait for a named person to approve each case. That position is sound when context is novel, evidence ambiguous, harm difficult to repair, legal authority personal, or legitimacy depends on a human hearing reasons and taking responsibility. A suspicious-activity reporting decision is not made delegable by excellent evidence assembly. A career decision is not converted into clerical execution by placing an “approve” button after a recommendation.

Universal approval becomes weaker for frequent, stable and tightly bounded acts. If a person sees hundreds of near-identical requests, the approval step can become an attention tax rather than a control. The interface may hide source evidence, present the agent's conclusion first or allow the action before the reviewer arrives. The label remains “human approval” while the operating reality becomes rubber stamping, retrospective awareness or approval camouflage.

The alternative is not unrestricted autonomy. Encode the stable policy as a delegation contract and reserve scarce human attention for exceptions that cross it. A servicing agent may request one of a declared set of missing documents, use an approved channel, schedule a follow-up inside a fixed case window and spend within a cumulative communication allowance. It may not waive policy, change customer status, close the case or extend its own authority. That boundary replaces repeated ceremony with a maintained organisational asset.

03 / Twelve clausesWrite the grant before compiling the permission

A delegation contract is a joined set of conditions, not a checklist whose strongest item compensates for a missing one. A well-authenticated agent with excessive purpose is unsafe. A narrow permission with no cumulative limit can still exceed the principal's tolerance. A comprehensive log that cannot identify the authority basis records activity without establishing legitimacy.

These clauses distinguish delegation from adjacent mechanisms. Paper 045 allocated typed decision rights across functions; this contract governs a principal's specific grant to a role occupant. Paper 051 designed commitments among several roles; this contract establishes whether any one edge may carry action authority. Identity architecture establishes who or what is present, while the contract establishes what that identity may do here and why. A tool allow-list is one compiled output, not the source of organisational authority.

04 / The authority frontierAuthority should shrink when operating certainty weakens

Advice and preparation allow the delegate to search, structure, compare or draft while a qualified person frames and makes the commitment. Reversible execution permits an act whose state can be restored promptly inside a narrow envelope. Conditional consequential execution permits a material act only when predeclared evidence, population, limits, monitoring and recovery conditions all hold. Non-delegable authority reserves judgement to authorised people even when an agent provides strong analysis.

The level belongs to an action object, not to an agent in general. The same servicing agent may autonomously request a missing document, prepare a policy exception for review and be prohibited from closing the case. Describing the whole system as “level four autonomy” erases the difference. A principal grants verbs over objects under conditions; no global autonomy label should silently confer more.

Authority must contract when evidence, context, identity or operating state becomes uncertain. If a data feed becomes stale, the agent should fall from reversible execution to preparation or stop. If a role transfer makes the principal stale, every dependent grant should suspend. If cumulative exposure approaches its cap, remaining nominal per-case headroom is irrelevant. If a tool is newly connected, it receives no inherited purpose simply because the agent can call it.

The five levels also prevent a common category error: treating human review as a single design. A reviewer who checks formatting after a decision is made does not exercise authority. A reviewer who receives only a compressed recommendation may be formally present but unable to reconstruct the evidence. A reviewer who can inspect sources, request more information, change the proposed act and stop execution holds a credible decision role. The contract therefore states what the person sees, when action waits, which alternatives remain available and how disagreement changes the workflow. Human presence without those conditions is ceremony.

Nor should the lowest level be dismissed as weak automation. Advice and preparation can create substantial value when they remove search, comparison and drafting burden while preserving the person's independent framing. The correct level is the smallest authority that produces the operating outcome, not the largest level that technology can demonstrate. Granting less also improves diagnosis: when a prepared case fails, investigators can separate evidence quality from execution authority instead of tracing an agent that searched, judged and acted through one opaque chain.

05 / Compile and reconcilePermissions are generated from the contract, then tested against receipts

A usable capability has two directions. Compilation moves from organisational authority into executable controls. Reconciliation moves from observed action back to the contract that permitted it. Weak systems perform only the first direction: they create credentials, scopes and workflow routes, then assume their existence proves correct use. Strong systems can answer both “could this identity call the tool?” and “was this act within the grant for this purpose, case, evidence state and cumulative exposure?”

Compilation begins with a versioned contract owned by the principal. Policy rules identify prohibited objects and human-only judgement. Workflow gates check entry evidence, case state, exception routes and response times. Identity services bind the delegate to a verified service account and role. Tool mediation applies fields, commands, resources, transaction limits and time windows. Aggregate controls count related acts across retries, channels, accounts and sub-agents. Monitoring joins action receipts to downstream verification instead of celebrating a successful API response.

Reconciliation is equally important because technical success can hide organisational breach. A refund API may return success while repeated acts exceed a cumulative limit. A document request may use an approved template but target a population outside the purpose. A human may click approve after the action was dispatched. A sub-agent may act under the parent's broad credential without a visible delegation edge. The receipt needs contract version, principal, delegate, case, evidence, decision object, allowed operation, actual effect and recovery state so those distinctions remain inspectable.

Contract changes are releases. Expanding the population, adding a tool, raising a limit or weakening a review condition is a change in authority, even when no model changes. Test the compiler against representative cases and explicit negative controls. Confirm that permissions shrink on expiry, role change and degraded evidence. Confirm that revocation cancels queued and in-flight work. Confirm that remediation can find affected cases from receipts. Independent assurance should examine whether this machinery operates, without becoming the first-line designer of every grant.

Implementation also needs a conflict rule. The most restrictive applicable clause should govern when policy, workflow and technical state disagree. If the organisational contract permits an act but the tool scope blocks it, the agent stops and reports a configuration defect. If the tool permits an act that the current contract prohibits, the broader technical access creates no authority and should trigger suspension. If two contracts appear to cover the same action with different principals or limits, the system should not choose the convenient one. It should identify the collision, preserve evidence and route it to the owners who can resolve the underlying decision right.

Receipts must remain useful without becoming an indiscriminate surveillance store. Capture the minimum evidence needed to attribute authority, reconstruct the decision and repair consequence. Apply retention, access and purpose limits to the receipt itself. Sensitive reasoning traces are not automatically necessary; often the decisive evidence, rule version, inputs, output, tool effect and exception state are more reliable than a verbose generated explanation. The organisation should know which record is authoritative, which fields can be corrected, who can inspect them and how a challenge attaches to the original act rather than disappearing into a separate complaint system.

06 / Negative controlsFive plausible controls that fail under real operating pressure

Prompt-only delegation. “Act within policy” is treated as a boundary while the agent can access unrestricted records and tools. Language can guide reasoning, but it cannot substitute for enforced action, data, purpose and exposure limits. The correct response is repair before use, not another warning sentence.

Approval camouflage. The workflow dispatches an action, then presents a human with a confirmation screen. Alternatively, it shows only the agent's conclusion and hides source evidence. The control is retrospective awareness or anchored assent. If human authority is required, action must wait for an authorised person who can inspect relevant evidence, refuse, change and explain the decision.

Cumulative exposure. Each refund sits below a per-case threshold, yet thousands of refunds across a day, a linked customer group or several agents exceed the principal's tolerance. Cumulative limits must follow the economic or harm object, not only the technical request. Retries, partial reversals and delegated sub-actions count toward the same envelope.

Stale authority. A manager changes role and no longer owns the outcome, but the agent's service account and scheduled jobs continue. Authentication still succeeds. Organisational authority has expired. Identity, role and contract lifecycle need joined events so a role change suspends dependent grants until a current principal renews them.

Self-extension. An agent creates a sub-agent, connects a new tool or lengthens a task horizon under its own broad credentials. Delegation cannot be self-authored. Any child grant must remain inside the parent's purpose, action, resource, time and exposure envelope, identify its principal and delegate, and produce a traceable receipt. If the system cannot enforce that inheritance, self-extension is prohibited.

07 / Worked boundaryA servicing agent receives a narrow grant, not general discretion

Consider a servicing team that handles incomplete applications. The accountable operations principal may delegate document requests and follow-up scheduling because the objects are stable, evidence is inspectable and the effects are limited. The agent can identify an item from a declared checklist, request it through an approved channel, schedule a reminder inside the case deadline and attach a receipt. It cannot infer a new policy requirement, waive an existing one, change customer status, commit a payment, close the application or suppress an escalation.

Entry requires an open case, verified customer-channel consent, a named missing item from the current policy version and no conflicting evidence. The population excludes vulnerable-customer flags and cases already in complaint, fraud or legal review. Frequency and cumulative limits bound messages per case, per customer and per day. If confidence falls, a document conflicts, a person contests the request or a response timer expires, the agent stops and routes the evidence to an authorised case manager.

The technical compiler maps that contract into a service identity, case-scoped reads, a document-template allow-list, a scheduling window and a prohibited write set. The workflow blocks closure and status change. Receipts join principal, contract version, case, evidence, message, channel, schedule, delivery state and any challenge. A revocation drill proves that scheduled messages and queued tool calls can be cancelled, then locates cases that require correction.

The adjacent suspicious-activity reporting decision stays with authorised people. An agent may assemble transactions, provenance, comparisons and contradictory evidence. It may not determine whether suspicion exists or make the filing decision. The boundary reflects legal and institutional authority, consequence and the need for accountable human judgement. Better preparation can improve the human decision without moving that decision into the delegated envelope.

Suppose the agent encounters a document that resembles an accepted item but comes from an unrecognised source. The contract does not reward completion. It requires the agent to preserve the source, mark the uncertainty and escalate without sending a speculative rejection. Suppose a customer contests an automated request. The next reminder is cancelled and the challenge reaches the case manager with the original evidence and contract version. These paths show why an exception is not an embarrassing failure of autonomy. It is evidence that the envelope is doing its organisational job.

The worked success is credible only if the team rehearses failure. Operators rotate the principal's credentials, expire the contract, revoke the agent during a queued reminder and simulate a breached daily communication cap. They verify that no child task survives, affected cases can be listed, and the service does not fall back to a shared account. A paper boundary becomes a capability when ordinary teams can execute these controls under time pressure and can show the resulting receipts to an independent reviewer.

08 / Interactive instrumentDelegation Contract Compiler

Describe one proposed grant. The compiler returns one of five routes and a minimum contract. Its red route has priority because valid authority, identity, enforcement, receipts and revocation are prerequisites, not factors to average away.

09 / Operate the capabilityMaintain delegation as an enterprise asset

Formal delegation should have an owner, register, version history and service. The register links each principal to active contracts, delegates, action objects, populations, resources, cumulative limits, expiry and dependent systems. A change in role, policy, data source, tool, operating state or law can then identify grants that need suspension or review. Without that join, responsibility changes in the organisation while machine authority continues in the infrastructure.

Measure the contract at its boundaries. Track attempted actions blocked by purpose or object, evidence failures, exceptions, human response time, overrides, contests, cumulative utilisation, downstream corrections, revocation time and remediation completion. High acceptance is not sufficient: it may indicate good routing, weak challenge or an interface that hides alternatives. Low exception volume can indicate stable work or an agent that fails to surface uncertainty. Read the measures together with sampled receipts and affected-party outcomes.

Renewal should ask whether the original purpose still exists, the principal still owns it, the delegate remains fit, limits reflect actual aggregate exposure, prohibitions match current policy, and revocation has been exercised. Narrowing is often the right response to uncertainty. Expansion requires new authority evidence and tests; it is not an automatic reward for usage. Retirement removes credentials, jobs, queues, tool grants and user expectations, and it retains receipts for the required period.

The deeper value is organisational clarity. When delegation is formal, boards can ask which consequences have moved and under whose authority. Managers can distinguish useful agent preparation from surrendered judgement. Technology teams can compile real purpose rather than infer policy from a prompt. Risk and assurance teams can test grants and receipts without becoming approval factories. Affected people can challenge an act through a route tied to an accountable principal.

Delegation is therefore neither trust in an agent nor distrust expressed as endless approval. It is a maintained institutional promise: this principal authorises this verified role to make this bounded commitment, for this purpose and population, with this evidence and exposure, while these judgements remain human, these receipts prove use, and these mechanisms stop and repair it. If the organisation cannot say and enforce that sentence, it has issued access, not delegated authority.

SourcesReferences

1. Jensen, M. C. and Meckling, W. H. (1976), “Theory of the Firm: Managerial Behavior, Agency Costs and Ownership Structure”, Journal of Financial Economics. doi.org/10.1016/0304-405X(76)90026-X.
2. Holmström, B. (1979), “Moral Hazard and Observability”, Bell Journal of Economics. doi.org/10.2307/3003320.
3. Aghion, P. and Tirole, J. (1997), “Formal and Real Authority in Organizations”, Journal of Political Economy. doi.org/10.1086/262063.
4. Jensen, M. C. and Meckling, W. H. (1995), “Specific and General Knowledge, and Organizational Structure”, Journal of Applied Corporate Finance. doi.org/10.1111/j.1745-6622.1995.tb00283.x.
5. Dessein, W. (2002), “Authority and Communication in Organizations”, Review of Economic Studies. doi.org/10.1111/1467-937X.00227.
6. Alonso, R., Dessein, W. and Matouschek, N. (2008), “When Does Coordination Require Centralization?”, American Economic Review. doi.org/10.1257/aer.98.1.145.
7. Lupia, A. and McCubbins, M. D. (1994), “Learning from Oversight: Fire Alarms and Police Patrols Reconstructed”, Journal of Law, Economics, & Organization. doi.org/10.1093/jleo/10.1.96.
8. Parasuraman, R., Sheridan, T. B. and Wickens, C. D. (2000), “A Model for Types and Levels of Human Interaction with Automation”, IEEE Transactions on Systems, Man, and Cybernetics Part A. doi.org/10.1109/3468.844354.
9. NIST (2023), “AI Risk Management Framework Core”. airc.nist.gov/airmf-resources/airmf/5-sec-core/.
10. Rose, S. et al. (2020), NIST SP 800-207: Zero Trust Architecture. doi.org/10.6028/NIST.SP.800-207.
11. NIST (2020), SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. doi.org/10.6028/NIST.SP.800-53r5.
12. European Union (2024), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. eur-lex.europa.eu/eli/reg/2024/1689/oj.
13. Institute of Internal Auditors (2026), “Statement of Position on the Three Lines Model”. theiia.org/en/resources/statements-of-position.
14. Federal Reserve, OCC and FDIC (2026), “Revised Guidance on Model Risk Management”, SR 26-2. federalreserve.gov/supervisionreg/srletters/SR2602.htm.
15. ISO/IEC (2023), ISO/IEC 42001: Artificial intelligence management system. iso.org/standard/81230.html.