Authorize the business actions an agent may take
Draft
Authorize the business actions an agent may take
Layer 4. Control AUTAuthorization
Allocation
| L4-AUT-02 | |
|---|---|
| Decides | Business Accountable Executive, or an executive with appropriate delegated authority |
| Consulted | CAIO, Head of Risk and General Counsel |
| Executes | Model Owner |
| Evidence | Action authorization naming permitted actions and limits |
| Delegated band | Delegated |
In plain terms
Decide what an agent is permitted to do in the business, and up to what value. This answers what it may do. How independently is L4-AUT-03.
What is being judged
The permitted action set, expressed in business terms rather than technical scopes. May issue a refund up to X is an authorization. Has write access to the payments API is a permission, and a permission list is not an authorization because nobody can tell from it what the agent will actually do.
Limits inherit from existing financial delegation. An organization that already knows what a director may approve does not need a parallel scheme, and building one produces two conflicting authorities. The AI-specific additions are a per-transaction limit and a daily aggregate limit, because an agent’s failure mode is repetition rather than magnitude.
Irreversibility overrides value. High-impact or irreversible actions default to human confirmation regardless of monetary value. Deleting a records archive, submitting a regulatory filing or terminating an account may carry no transaction value at all.
What this decision does not cover
It does not set the confirmation mechanics or the control surface; that is L4-AUT-03. It does not classify the interfaces the agent invokes, which is the Layer 2 action surface classification.
When it fires
On event. Before an agent takes any action in production. On extension of the action set. On a change to the underlying financial delegation. When an action is attempted outside the authorized set, which is a finding regardless of outcome.
On cycle. Per the stated review cycle on the authorization.
What you need before deciding
The action set the agent can technically perform, which is usually wider than what it should. The financial delegation for the equivalent human role. The Layer 2 action surface classification for every interface it invokes. Which actions are irreversible.
How this goes wrong
Authorizing the capability rather than the actions: the authorization mirrors the API surface, so any action the integration permits is treated as authorized. Value as a proxy for consequence: limits set purely in currency, so the irreversible zero-value action passes. Aggregate blindness: a per-transaction limit with no daily aggregate, so a thousand small correct-looking actions produce an outcome nobody authorized.
Related decisions
Upstream L4-CLS-04, L4-CLS-06, L4-AUT-01.
Paired L4-AUT-03, which is always decided alongside this.
Depends on L2-04 action surface classification.
Thresholds §5A agent transaction and aggregate limits.
Instrument references
None. No instrument in the crosswalk governs an AI system that acts rather than informs. Recorded as crosswalk gap 5; the full action surface specification is deferred to the v1.0 overlay.
Correction
The maintainer answers corrections. There is no service level. Responses are best-effort and opportunistic within a reasonable time: a correction raised on a Monday is answered that week or sooner.