The Second Authority

A high-consequence action does not run on one approval. A wire above a threshold. A model promoted to production. A claim paid over a limit. Two parties have to concur, and the record has to hold both. Most agent logs hold one.

The control that requires a second party is older than the agent. The agent is what makes it disappear.

The control is older than the agent.

Segregation of duties is a standard control. One party proposes, a second authorizes, and no single actor can complete the action alone. Banks run it on large transfers. Hospitals run it on controlled substances. Change management runs it on production pushes. The point is not redundancy. The point is that the authority to complete the action was never held by one party.

An agent collapses the two roles by default. It proposes and it acts, in one process, on one credential, in the same instant. The second authority is the first thing that goes missing when the work moves to an agent, because nothing in the run forces it to exist.

Two authorities, one act.

When an agent action needs a second approval, two authorities govern it. The agent holds the first, bounded by the envelope it runs under. The concurring party holds the second, a human or another agent under its own envelope.

The action is authorized only when both hold. So the record has to show both held, and that the concurrence existed before the action ran. A concurrence recorded after the act is a different fact, and an examiner can tell the difference. The examiner pulls one decision and asks who else had to say yes, and when.

What the log loses.

A typical agent log shows the action and the actor. One identity. One timestamp. It does not show that a second authority was required, who held it, whether it was given, or when it was given relative to the act.

Reconstructing that later is the expensive part. The approval lived in a message thread, a ticket, an inbox. The link between that approval and the specific action is inferred from timestamps, not recorded as a fact. The control was run. The evidence that it was run is the thing nobody kept.

Concurrence has an order.

The order is the whole control. The second authority has to concur before the act, on the specific action proposed, not on a class of actions in general. A standing approval for wires under review is not concurrence on this wire.

So the record has to bind the concurrence to the proposed action by its content, and seal it at its position before the outcome it authorized. If the order is not on the record, dual control reduces to two signatures with no proof of sequence. An examiner reads that as one.

When the second authority is also an agent.

Maker and checker does not require a human checker. A second agent under a separate envelope can hold the concurring authority. That raises the question the record then has to answer. Did the two draw on independent grounds, or the same one.

Two agents that share a model, a context, and a confidence signal are one authority wearing two names. The record has to show the second authority was independent of the first, or the control is theater. This is the common-mode problem, moved from monitoring to authorization. A checker that concurs for the same reason the maker proposed adds a signature and no assurance.

What we are building.

Wayfinder Systems Group signs both authorities onto one record. The agent grant and the concurring authority, with the concurrence bound to the proposed action by its hash and sealed at its position before the act. The examiner reads one record and sees who else had to say yes, and when, and whether the two were independent. Patents held in The Wayfinder Trust. We call her Velma.