Permission Is Not Authority

A scoped permission set is the control most teams reach for to govern an agent. It is set at provisioning, before the agent runs, and it fixes what the agent may touch. It does not decide what a single action, taken partway through a run, is allowed to do.

That second decision is the one an examiner pulls. Permission answers whether the agent may reach a tool. It does not answer what governed the reach.

The grant and the act.

A permission is a boundary drawn once. It names the tools, the scopes, and the data an agent is cleared to touch, and it is fixed at the moment it is granted. Every action the agent takes for the rest of the run reads against the same standing grant.

Authority is a decision made per action. It is set when the agent proposes the act, against the run so far, and it can be full for one action and reduced for the next. A permission cannot make that distinction. It was written before either action existed, and it says the same thing to both.

Inside the permission set.

The failure surfaced in the open this June. A runtime-security research group reported that scoping an agent to least privilege does not hold, because an agent can act outside its intended purpose while staying inside the permissions it was granted. The permission set was not breached. The behavior still went where it was not supposed to go.

That is the gap. A permission set bounds the surface an agent can reach. It cannot see the sequence of steps the agent walks across that surface, and it cannot lower what a step is allowed to do when the sequence turns. Every action inside the boundary is equally permitted, including the one that should have been stopped.

What a permission cannot carry.

A permission is a static predicate. May the agent call this tool. The answer is fixed for the length of the run, and it is the same answer whether the call is the first the agent makes or the hundredth, whether the run has behaved or diverged.

Authority is a runtime value on a continuum. Given the trajectory to this point, how much of this action's effect is allowed to land. It falls when realized behavior diverges from what the agent was assured to do, and a permission has no such motion. It was set before the divergence could exist, and nothing in the grant reads the run.

A control that cannot move with the run cannot govern the run. It can only draw the edge of the field.

Permitted is not governed.

The examiner does not pull the permission set. The examiner pulls one action that affected a person and asks what governed it. A permission grant answers a smaller question, whether the action was inside the cleared surface, and stops there.

Permitted is not the same as governed. An action can sit entirely inside the permission set and still be the action a governor would have reduced or refused. The record that shows the standing grant does not show the authority the action carried, because a standing grant does not carry one.

Where the line gets drawn.

SR 26-2 took effect on April 17, 2026 and placed agentic AI outside its scope, pointing institutions back at their own risk practices. Permission scoping is the practice most teams reach for first. It is necessary. It is also the boundary of the field, not the control loop inside it.

The buyer who treats a permission set as governance has bought a boundary and called it a control. The action still needs an authority set per decision, read against the run, and recorded. That control is a separate thing from the grant, and it is the thing the record has to hold.

What we are building.

Wayfinder Systems Group sits between the agent and the record. It does not issue the agent's permissions and it does not replace them. It reads each action the agent proposes, sets the authority of that action against the run so far, and signs the value onto a tamper-evident chain before the action lands. The permission says the agent may act. The authority says how much this act is allowed to do, and the record holds it. Patents held in The Wayfinder Trust. We call her Velma.