Your agent didn’t hallucinate; it exceeded its authority

Content filters can block unsafe output. They cannot tell you whether an agent was authorized to issue that refund, touch that production system, or commit the company to an external action. Those are different problems, and most enterprises are only solving the first one. An AI agent can follow its instructions perfectly and still take an action the business never sanctioned. In commerce environments, I have seen this pattern emerge in practical ways. A service workflow calculates the correct refund amount but lacks a boundary preventing credits above what the business approved for autonomous action. An order agent correctly applies a requested change but overlooks a financing or fulfillment condition. A procurement agent identifies the lowest-cost supplier, but nobody has defined whether it can accept contractual terms or only recommend the option. The agent keeps working. The problem may not surface until something downstream breaks. These are not necessarily AI reasoning failures. They are failures to separate technical capability from business authority. As enterprises move from copilots that recommend to agents that call tools and trigger workflows, every production agent needs explicit decision rights: What it may execute, what requires approval, what it may only recommend, and what it must never touch. Guardrails remain necessary. But a guardrail is not an authority model. Safety controls and decision rights solve different problems Early gen AI controls screen harmful content, protect sensitive information, validate responses, and constrain tool behavior. That work matters. Decision rights answer a different question: Even when an action is safe and technically valid, is this agent authorized to take it on behalf of the enterprise? That governance gap is becoming harder to ignore. In April 2026, a Cloud Security Alliance survey found that 65% of respondents had experienced an AI-agent-related incident in the prior year, while 82% had discovered previously unknown agents operating in their environments. The survey involved 418 IT and security professionals and was sponsored by Token Security. The findings illustrate how quickly agent activity can outpace the visibility and ownership structures built for conventional software. The World Economic Forum’s May 2026 playbook reflects this shift. It introduces an Agent Capability and Authorization Profile designed to make delegated actions auditable, enforceable and accountable. Guardrails constrain behavior. Decision rights define legitimate authority. Give every production agent an authority contract Before an agent receives access to enterprise tools, it needs a machine-enforceable record of exactly what authority the business has chosen to delegate. Call it an Agent Authority Contract . At minimum, that contract should answer seven questions: Who owns the outcome? Name a human or business role, not another system.

What may the agent do? Read, recommend, write, or commit?

Which systems and data may it reach?

What materiality limits apply? Define dollar thresholds, record counts, customer scope, and operational impact.