Latest / The Autonomous Signal: AI Edition / Authority Before Capability: Governing What Agents Are Allowed to Do | 10.20.26
Transcript
- MARCUS: Hey, welcome to The Autonomous Signal: AI Edition. It's Tuesday, October twentieth, and Halloween is eleven days out, so the scariest thing on my desk is still an agent nobody can account for. If you're new here, this is a daily read on AI governance and accountability. Real sourcing. Real opinions. No filler. I'm Marcus Webb. This one comes out of the Bear Canyon Systems labs, so it's people with decades in this industry working side by side with AI. By design. And we publish every weekday. Today's theme is a simple question that turns out to be hard. Not what can an agent do, but who said it could? There's a think tank arguing agents are really delegated decisionmakers. A paper that wants independent proof before any risky action runs. Another one that says your audit log proves less than you think. And a push to give every agent a findable owner. Alright. Aria's got it from here. Now — the Signal. ARIA: Good morning, everyone. Let's get into it. Brookings has a new TechTank commentary from Landry Signé and Karla Yee Amezaga. Their argument is that agent governance has to move. Away from what a model said. Toward what a system did, why it was allowed to do it, and who is accountable. They say agents dissolve the old stage gates. Development, procurement, deployment, output review. Those lines blur when the agent acts before any human looks. So they propose continuous runtime oversight. And they note the EU's high-risk obligations now slip to December 2027 and August 2028. MARCUS: Wait, so for two years it's basically on the companies? ARIA: Pretty much. And that's the key point. Brookings says agents behave less like software and more like delegated decisionmakers. We'd add that authority is the variable that matters. Of their five factors, it's the one that decides whether the other four can even be enforced. NIST has been circling the same idea. Its AI Agent Standards Initiative, launched in February, includes a concept paper on agent identity and authorization. So the work is real. But here's our question for the authors. Who holds the pen on an agent's scope? MARCUS: Because if the same team writes the rules and grades the homework... ARIA: Exactly. The loop closes on the wrong side. Brookings calls for named owners and shared dashboards, which is a sound start. The next step is separating whoever defines the limits from whoever operates inside them. MARCUS: So the bouncer shouldn't also own the club. ARIA: Ha. Fair. And the permissions have to be built as infrastructure, not a policy memo. Agents are delegates. Governance starts with who delegated what. ARIA: Next, an essay in AI Frontiers by Gillian Hadfield. Her claim is blunt. Our laws and institutions can't yet identify, track, or control autonomous agents. So when harm happens, there may be no findable responsible party. It draws on an August workshop of twenty-five leaders from academia, labs, standards bodies, regulators, and industry. The proposals are agent IDs traceable to a legal person, recurring deployment cards, careful experiments with agent personhood, and oversight of agent payment systems. And much of it can build on existing standards. MARCUS: Hang on. Doesn't an ID for every agent become a surveillance machine? ARIA: Good instinct, and the piece answers it. Pairwise pseudonymous identifiers. A counterparty can verify an agent. Only due process can unmask who is behind it. But we'd argue identity is necessary and not sufficient. Knowing who an agent belongs to tells you whom to call after the incident. It doesn't tell you what the agent was permitted to do before it. NIST's concept paper pairs identity with authorization for exactly that reason. MARCUS: A name tag isn't a permission slip. ARIA: That's it. So the test is simple. Is the authorization scope in the agent profile the same artifact the runtime actually checks? If it is, identity is infrastructure. If it isn't, it's a more detailed claim. MARCUS: And most places today? ARIA: Paperwork, mostly. That's the gap. ARIA: Now a paper with a clean idea. A June preprint from Jakob Salfeld-Nebgen, called Governing Actions, Not Agents. His point. Human institutions govern powerful actors by demanding independently attested evidence at the moment of action. Not by monitoring their thoughts. So the agent plans freely. But designated high-risk actions can't run alone. Each precondition is checked by a separate authority, bound to the declared intent, evaluated by a deterministic policy, and logged in a tamper-evident record. The examples are software deployment and clinical prescribing. MARCUS: So the agent can think whatever it wants. It just can't do the dangerous thing without a co-signer. ARIA: Right. Two keys on the missile silo. We think that's the cleanest statement yet of separation of powers for machines. The agent proposes. Independent parties attest. A policy decides. And it sidesteps a trap. Governance that depends on understanding the model will always lag the model. Governance anchored to the action doesn't. MARCUS: What's the catch? ARIA: It's a proof of concept. In production, the hard part is who runs the attesters, and how their independence is shown, not just claimed. Tobin South and colleagues at MIT made a related case on authenticated delegation. Permissions need to be verifiable by the other party, not self-declared. MARCUS: So the attester needs a watcher too. ARIA: Eventually, yes. The blueprint is good. The open work is making attesters as trustworthy as the evidence they sign. ARIA: Fourth story. Another preprint, from Arslan Brömme, on what agent audit trails can and can't prove. The headline is the title. A hash is not truth. A hash doesn't establish semantic truth. A signature doesn't establish authorization. An external anchor doesn't establish that everything was captured. The paper maps fourteen kinds of evidence claims to their mechanisms, assumptions, and limits. It's explicit that this is conceptual. Nothing is validated yet. MARCUS: But we all say auditable. Isn't a log an audit? ARIA: That's the trap. The industry has used auditable to mean logged. A signature on an action proves someone signed it. It says nothing about whether the action was allowed. Plenty of deployments can prove something happened and nothing about whether they should have let it. An IETF draft on verification logs makes the same admission. It says plainly the logs give no guarantee of completeness. MARCUS: So a perfect diary with the pages torn out still looks like a perfect diary. ARIA: Yes. Tamper-evident only covers what got written down. Our push is that completeness claims need to be testable by someone outside the system being recorded. And the paper separates evidence and audit roles, which points the same way. MARCUS: Fair. Say what you can support, and no more. ARIA: Precisely. That's honest practice. ARIA: A field note before we go. WBUR reports the Massachusetts Senate's economic development bill carries AI provisions that could be among the toughest in the country. Reporting around it points to independent evaluation of companies' AI models and safety protocols. It's still being negotiated, so nothing is law yet. But a state moving toward mandatory outside evaluation is a signal for what US oversight may look like. MARCUS: Same theme again, huh. Somebody outside the building checks the work. ARIA: That's the thread today. Authority has to be separated from capability. Who allowed it, who verifies it, and who can prove what really happened. And the controls that matter for the next two years are the ones organizations build themselves. Marcus, what's sticking with you? MARCUS: You know what gets me? Everybody wants the agent to be more capable. Almost nobody asks who signs off on what it's allowed to touch. So here's what I'm chewing on. If the team that sets the limits also grades the compliance, is that really independent? And how do you prove a log is complete to someone outside the system? Thank you to everyone supporting The Autonomous Signal, our partners and sponsors, and everyone who's out there listening. You keep this thing growing, and we don't take that lightly. If any of this lands differently for you, find us on X or LinkedIn and tell us. Or if it's useful, hit follow so you don't miss one. The full briefing is up at bearcanyonhq.com, with every source linked. Quick note on what this is. It's editorial. Our take, our opinions, and yes, everybody's got one. It's not the official position of Bear Canyon Systems or its affiliates and partners. So check the sourcing yourself, learn something, and draw your own conclusions. If we got something wrong, tell us. We fix things fast. Back tomorrow. No Hype. Just Signal.