Authority Does Not Delegate

An autonomous agent seldom acts alone. It calls a tool, hands a step to a sub-agent, and that one calls another, until an action reaches an actuator several hops from the agent that began the run, and the authority that action carries is not a grant handed down the chain. A runtime governor sets it at the actuator, on what the action would do and where the run is heading, no matter who proposed it, which is where Wayfinder Systems Group sits, above the control and below the model.

Delegation is how agents get work done now. It is also how authority quietly escapes, when a grant made to the agent at the top is treated as authority for everything that agent sets in motion.

What does a delegation chain actually move?

An action is the thing that becomes a durable effect. A write to a record. A transfer. A message sent. A command issued to a machine. Delegation does not add actions of a new kind. It changes who proposed the one that lands. The top agent plans, a sub-agent it spawned executes a step, a tool it called performs the write, and the write is still a write at the same actuator it would have reached if the top agent had done it directly.

A chain of ten agents and one actuator is still one actuator. The depth of the chain is a fact about how the work was organized. It is not a fact about the effect. The effect is the same size whether one agent reached it or six handed it along, and the thing that has to be bounded is the effect.

The authority a governor grants is how much a single action is allowed to do, set at the actuator the instant before the action runs. It attaches to the action, not to the agent that asked for it. An action proposed by a sub-agent four hops down is an action, and it is granted on its own terms.

What does a delegated-authority model carry down the chain?

The familiar way to bound a delegated action is a scoped grant. A scope is drawn up front, before the run, and it states what the holder may do. The holder passes some or all of it to whatever it calls, and the callee acts under the authority it was handed. A scoped token is a bearer instrument. Whoever holds it acts with the authority written on it.

That model answers a different question than the one a governed run asks. A scope says the holder is permitted to touch a class of resource. It does not say how much this action, the one about to land, is allowed to do, given what the run has done so far and where it is going. A scope is fixed before the first step and spent down as the chain proceeds, and nothing in it falls when the run starts to diverge.

A governor carries nothing down the chain. There is no token to pass. Each action is graded at the actuator against a bound declared before the run, on the effect it would have. A sub-agent holding a scope inherited from its caller has inherited a permission, not a grant. Permitted is not granted.

Why does depth in the chain not raise the grant?

Walk a grant down a chain and the temptation is to let trust accumulate. The top agent was cleared, it chose this sub-agent, the sub-agent has run clean for an hour, so the action it now proposes looks safe on every present signal. A control that reads the present signal grants more as the run goes well.

A governor reads where the run is going, not only how clean the current step looks. It can grant less authority on an action a sub-agent proposes whose present trust reads higher, because its forward look caught the run turning before the step landed. Depth in the chain is invisible to that judgment. The effect of the action and the direction of the run are not.

When the forward look is uncertain, the grant falls rather than rises. A long chain is more uncertain than a short one, because each hop is another place the run could have turned. Treating an action as more trustworthy because it sits deep in a chain is the move a governor refuses.

Where the governor has to sit for a chain.

The grant bounds the action only while the action cannot reach the actuator except through the governor. Put the governor at the top agent's boundary and a sub-agent that reaches a durable effect by another path is ungoverned, whatever the top agent was told it could do. A chain is a set of paths, and a bound holds only on the path the governor is on.

So the governor sits at the actuator, the one place every action in the chain has to pass to become a durable effect, however many agents handed it along. The question it answers is not who is calling. It is what this action would do, and whether the declared envelope covers it. A caller the governor has never seen, spawned mid-run by an agent it has never seen, reaches the same actuator and is graded the same way.

There is work that records a delegation chain after it runs, a trace of who called whom reconstructed from an ordered set of records. That trace is useful and it is not a bound. It names the hops after the effect has landed. A governor sets the authority of each hop's action before the effect lands, which is the difference between a record of the chain and a control over it.

What the rules ask, and what they leave open.

The instruments converging on agents name a person and name an obligation. EU AI Act Article 14 asks that a high-risk system be designed so the people assigned oversight can monitor, override, or interrupt it, with high-risk obligations applying from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component under Regulation (EU) 2026/1744. SR 26-2 took effect April 17, 2026 with generative and agentic AI placed outside its scope and the interagency request for information it promised still not issued. The NAIC exposed version 5.0 of its AI Risk Evaluation Supplement, with a later version on the way to the Fall National Meeting in November. On October 8 the United Kingdom's data protection authority opened a call for evidence on the data-protection risks of agentic AI.

Each addresses the agent as though one system takes one action. None asks what happens when the action that lands was proposed four hops down a chain the deployer did not script, and whether the authority it carried was established fresh at the actuator or inherited from the agent that started the run. A scope handed down a chain is tested once, when it is drawn. A bound in the path is tested on every action, by whichever agent reaches the actuator.

What we are building.

Wayfinder Systems Group builds a runtime governor that sits above the control and below the model. It observes the run, assesses each action, modulates how much authority that action carries against an envelope declared before the run, enforces the grant in the path so the only thing that reaches the actuator is the action already cut to it, and signs the record of what it decided. Authority attaches to the action, not to the agent that proposed it, and it is set at the actuator no matter how many hands the action passed through to get there. A grant is never a token the chain carries down. We call her Velma.