An AI agent can be authorized at every step and act on a rule nobody has confirmed

Platforms check what an agent may do. The rule it applies comes from a document. A "supporting rule" column names that document.

Some agent platforms are starting to check, at every step of a task, what an AI agent is allowed to do. That check covers the right to act; it says nothing about the rule the agent acts on. The agent finds that rule in the company’s internal documents: a policy, a memo, a grid. AI agent authorization says an agent may issue a credit note up to a ceiling; a document tells it which customer qualifies. The vendors’ promise therefore reads both ways: an agent that stays within its scope operates freely, on a sound rule or on a rule nobody ever settled, and in both cases the authorization check stays green. Hence the line to take into the steering committee: autonomy is earned one document at a time. When the document carrying the rule is identified, current and confirmed by its owner, the action can move to autonomous mode on a basis you can defend. When it is not, authorization makes an error look compliant.

Picture a Monday at a business-services group. The agent authorization committee, made up of the head of customer relations and the CISO, approves the scope of a “commercial goodwill” agent: after a billing incident, it may issue a credit note to a business customer, up to a ceiling. The CISO signs. Three weeks later, credit control finds credit notes granted to customers the finance policy would not have deemed eligible. The agent applied the criteria in a sales memo stored in the sales team’s workspace, also current, which says something different. The log is spotless: identified agent, action in scope, ceiling respected. The CFO then asks the CISO the question he was dreading: “You authorized this agent. On what rule?”

The backdrop is dated. On 15 October 2026, ServiceNow announced AI Passport, a signed credential that an agent presents at runtime to verify its authorized scope, at every step of a workflow involving several agents. According to the vendor, as long as the agent stays within that scope it can operate freely; if it drifts, graduated responses apply, up to termination (availability announced for Q4 2026). What transfers to a non-tech enterprise is the movement: the agent’s authority is becoming an object that is checked continuously. What does not transfer is the tool: the same movement will arrive through whichever platform your IT department selects.

This article is for the CDO or CTO preparing the move to agentic AI in 2027, and for the CISO who will sign scopes of action. If your agents still only answer questions, the argument will bite the day the first of them executes an action that commits the company.

Two answers come to mind. The first, in-house, narrows the scope: lower ceilings, fewer autonomous actions. It caps the size of the error without touching its cause. The second trusts the tool already bought or being bought: agent control tower, identity management, audit log. It governs the agent’s authority; it has no idea which of the two memos the agent read. One objection remains: according to ServiceNow, the passport is grounded in the configuration management database (CMDB), governance, risk and compliance (GRC) policies and workflow approvals. Those sources say what the agent may do. The business rule it applies while doing it, who qualifies for a credit note, lives in the documents it consults.

A note for regular readers. On 28 September we discussed who owns the documents an agent cites; on 28 October, how long it takes to say which document is authoritative before building an agent. Here the object changes: the pair formed by an authorized action and the rule behind it, at the moment the scope is granted.

What the agent reads when it acts: authorization on one side, the rule on the other

Take the commercial goodwill agent’s task: handle a business customer’s billing complaint and, if conditions are met, issue a credit note. To act, it needs two distinct things. The first is authorization: the billing tool, the “create credit note” action, the ceiling. The committee grants it, the platform encodes it, every call checks it. The second is the rule: which customers qualify, after which kind of incident, with which supporting documents. That one the agent looks for in the documents its configuration opens to it, at the time of the task.

Three cases arise. In the first, a single document carries the rule, it is current, and its owner, the credit controller, has confirmed that it is the basis for the action: the agent applies the right rule and the credit note is defensible. In the second, two current documents cover the same subject and diverge, like the finance policy and Monday’s sales memo: the agent picks one without saying so. In the third, no document carries the rule: the agent reconstructs it from neighbouring cases.

This is unsupported authorization: an action granted and checked, whose rule no document owner has confirmed. It is counted by listing an agent’s authorized actions and flagging those for which nobody can name the document behind the decision, its version and its owner.

That list is what gives the committee line its meaning. An action whose rule is confirmed can be granted autonomous mode sooner, because the committee knows what it is signing; an unsupported action stays in “the agent proposes, a human validates” mode. We have no measurement of this gain. It is a mechanism, and it can be checked at the next scope review: the actions whose rule was confirmed are the ones you can release.

The status quo has a precise cost too: every action granted without support adds decisions that the audit log will present as compliant.

What agent governance does best, and where it stops

At their best, agent governance tools cover a lot. ServiceNow describes a credential specific to each agent, verifiable at every step, revocable with precision, and a delegation that narrows at each step; the control tower keeps the full audit record of actions. SAP, at its TechEd conference on 27 October, presented a governed gateway through which third-party agents will be able to call its Joule agents; according to SiliconANGLE’s report, the vendor also suggests that compliance-sensitive procedures run an exact, prescribed sequence of steps through a deterministic workflow tool. Identity, scope, sequence, trail: the agent’s authority is governed.

The boundary lies in what these tools compare. They compare the requested action with the granted scope. They do not compare the applied rule with the document that should carry it, because that document lives in a DMS, an intranet site or a team workspace, and nothing links it to the scope. Even a deterministic workflow faithfully executes the rule it was given; it cannot know whether that rule is the one in the current policy. That link is what the CISO cannot establish alone: he signs off on authority, not on a business rule.

French law already requires competence alongside authority in a delegation

The issue is not new. In French criminal labour law, the criminal chamber of the Cour de cassation has held since its ruling of 11 March 1993 that a company head can be relieved of liability if he proves he delegated his powers to a person with the necessary competence, authority and means. Authority alone is not enough: in a ruling of 8 December 2009, the Court dismissed the appeal of an executive relying on a delegation, because it had not been established that the delegate had sufficient competence and authority.

This rule applies neither to an AI agent nor to a document; applying its structure to an agent’s authorization is our reading, and the case law does not make it. The comparison concerns a factual position: when a company entrusts a decision to someone, it has learned to check that they know which rule to apply, not only that they are entitled to act. An agent’s passport documents authority and means. For an agent, competence depends on the documents it reads.

The “supporting rule” column in the scope sheet

The step requires no new tool: for the first agent that will execute actions, add to its scope sheet a column naming, for each authorized action, the document that carries its rule.

What the step produces. A “supporting rule” column in the agent’s scope sheet. Six fields per action: the authorized action and its limit; the business rule it applies; the document that carries it, with reference and version; the owner of that document; the date of confirmation; the mode granted (autonomous, or proposed for validation).

Where it lives. The scope sheet the authorization committee already keeps for each agent, in the risk-governance tool or the authorization file. The CISO remains its custodian; the column transfers ownership of no rule to him.

When. At the next scope request or renewal, and at the latest before an action moves from “proposed” to autonomous mode. That moment is distinct from the incident: you do not go looking for the document behind a credit note once credit control has already challenged it.

How to build the list. Ask the agent platform administrator for the list of actions and tools open to the agent, with their limits. Start with actions that commit the company to a third party: a credit note, a delivery commitment, a contractual reply. If there are fewer than five, take them all. The session brings together the administrator, the CISO or a delegate and, for each action, the presumed owner of the document. If nobody recognizes themselves as owner, the line goes to the relevant process owner, who appoints one.

A completed line. “Action: issue a commercial credit note to a business customer, within the granted ceiling; rule: eligibility for a goodwill gesture after a billing incident; document: commercial goodwill policy, finance department, current version; owner: credit controller; confirmation: requested; mode: proposed for validation until confirmed.”

How to read it. An action whose document is single, current and confirmed by its owner can be granted autonomous mode within its limit. An action for which two documents present themselves stays in proposed mode until their owners designate the one behind the decision. An action without a document raises a question for the process owner: either the rule deserves to be written, and he writes it, or the action leaves the scope.

In the meantime. While a line awaits confirmation, the agent prepares the action and a human validates it; the task moves forward, the decision stays human.

If it fails. If every action has a single, confirmed document, the exercise will have cost half a day and the CISO will know what he signs. If even one does not, you know which autonomy to postpone, before an after-the-fact control tells you.

The record it creates. Writing that an owner confirmed the supporting rule of an action creates a trace: if the rule was wrong, it will show who confirmed it and when. Our reading, argued and without any published decision to rely on: a written, dated confirmation is more defensible than an authorization nobody can say was based on anything. For an action that commits the company to a third party, legal reviews the wording.

Who owns the decision. No new role: confirmation falls to the existing document owner, through a written assignment added to their role. The time spent is charged to the agent deployment programme, which is already budgeted.

What a Document Knowledge Platform brings, and what it does not

A Document Knowledge Platform (DKP) is the document quality and governance layer that runs upstream of AI systems: it governs the document estate (Govern), detects and handles anomalies, duplicates and obsolescence (Clean), and activates the corpus for agents only once those two steps hold (Activate). It is not sold in the agent governance category, nor in identity and access management, nor in risk-governance tooling, and it replaces none of these; it works on the documents agents consume. The scope of action stays administered in the agent platform; the DKP handles the document side.

On the column, K-AI’s contribution is specific. K-AI counts the documents that cover the same subject, indicates the applicable version of each, and flags obsolete documents and competing versions held elsewhere. When the list of actions is added to the scope, the tool proposes candidate documents for each, and the owner confirms the link. The decision to confirm, write the rule or withdraw the action stays with the business.

Ingestion covers only the document content retained in scope, set by contract and jointly approved by the document owner and the CISO or DPO. No transcripts, no usage logs, no telemetry. No content is reused to train models.

A real-world case gives an order of magnitude for the neighbouring problem. At TotalEnergies Retail Power & Gas, the customer chatbot relied on around 500 pages of official web documentation; K-AI’s diagnostic identified 19% of pages needing correction, and 53% of cases were resolved in 3 weeks, with 1 to 2 experts working half a day to a day per week. This measurement shows that an official reference set, in production, can carry a significant share of pages to correct, and that a small team can resolve part of them within weeks. It concerns an assistant that answers questions, and establishes nothing about agents executing actions, which were not its subject.

Conclusion: audit, clean, monitor

Auditing means adding the “supporting rule” column to the scope sheet of the first agent that acts, and filling it in once. Cleaning means having owners designate the document behind each action, writing the missing rules, and removing from scope the actions that have none. Monitoring means building the supporting-rule check into every scope renewal and every revision of the documents concerned: the revision already says who to inform; it will also say which agent scopes to review.

At the next committee, the CISO will know, for every action he signs, which rule the agent will act on, and who confirmed it.

Frequently Asked Questions

What is an AI agent’s scope of action?

It is the set of tools and actions an agent is authorized to use, with their limits (amount, type of operation, systems involved). Recent platforms check it at runtime, at every step of a task, and can restrict or stop an agent that drifts outside it.

Why isn’t an agent’s authorization enough to ensure the quality of its actions?

Authorization says what the agent may do. The rule it applies while doing it, such as customer eligibility criteria, comes from the documents it consults. If two current documents diverge, or none carries the rule, an action can be authorized, logged and still poorly founded.

Who should confirm the rule an AI agent acts on?

The owner of the document carrying that rule, through a written assignment added to their role. The CISO or the authorization committee grants authority; they do not become owners of business rules.

Should we lower agents’ ceilings in the meantime?

Lowering a ceiling caps the size of an error without addressing its cause, and slows the agentic transition. “The agent proposes, a human validates” is a more precise interim rule: it applies only to actions whose rule is not yet confirmed.

How does K-AI handle confidentiality during an analysis?

K-AI ingests only the document content retained in scope, set by contract and jointly approved by the business document owner and the CISO or DPO, never by IT alone. No transcripts, usage logs or telemetry are collected, and no content is reused to train models.

Sources

Where to Go From Here

K-AI Corpus Diagnostic — 10 business days on your document estate, full report of the 20 most critical anomalies, money-back guarantee if no meaningful anomaly is found. A one-hour conversation starts from your column and the actions it surfaced; it locates the subjects on which several current documents compete and clarifies what it would take to count them. Reach the K-AI team: contact@k-ai.ai. The scope of every diagnostic is validated jointly by the business Document Owner and the CISO/DPO, never by IT alone.

K-AI already works with CMA CGM, Veolia, PwC, BNP Paribas, TotalEnergies and CEVA Logistics. Partners: AWS, Snowflake, Microsoft, Wavestone, Devoteam.