What the Override Granted

Every agent platform shipping today has an escalation path. The agent hits something it cannot resolve, stops, and asks a person. That half is built.

The return path is a button, and what the button granted is not written down anywhere.

The escalation is the built half.

The joint guidance on careful adoption of agentic AI services, issued in May 2026 by CISA and the FBI alongside the national cyber centres of the United Kingdom, Canada, and New Zealand and the Australian Signals Directorate, tells operators to configure agents to fail safe and escalate to a human reviewer under uncertainty rather than proceed on a best effort. A DHS-CISA analysis this month goes further and asks for documented human-override mechanisms for consequential decisions.

Read those two asks together. The first says the agent must stop and ask. The second says the answer has to be documented. Almost every implementation satisfies the first and reads the second as a logging requirement it already met.

It has not met it. The log says a reviewer approved at 14:32. That is a record of a click. The override is not a click. It is a grant of authority. The document the guidance is asking for is the record of the grant, and the two are not the same artifact.

Approved is not a grant.

A companion piece argued that inside a run, authority falls when behavior diverges and does not climb back on the agent's own signal. It closed by saying restoration is a separate authorized act. This is the piece about that act.

When the reviewer approves, authority rises. That is the only thing in the architecture that can raise it. An event that moves the one value the governor uses to bound every subsequent action is the most consequential thing in the run, and it is typically captured as a boolean.

A grant has parts. Who granted it. What action it covers. How far the authority rises. When it stops. Whether it can be used more than once. An approval record holds the first and implies the rest, and everything implied is a reconstruction the examiner has to take on faith.

A grant has a scope and an end.

Two of those parts do the most work, and they are the two most often missing.

Scope is how far authority rose. A reviewer looking at a single blocked action approves that action. The system frequently reads the approval as a return to the authority the agent held before the divergence. Those are different grants. The reviewer cleared one payment. The run resumed with a general authority nobody granted.

An end is when the grant lapses. A grant with no expiry is standing, and a standing grant is a permission. That is the failure this series has described from the other direction. The reviewer thought they were unblocking a step. The record shows they widened the run's envelope for the rest of its life.

The grant binds to the action, not to the agent.

The reviewer sees a proposed action and decides on that basis. The action they were shown is the object the grant attaches to. If the grant attaches to the agent instead, the agent can present one action, receive authority, and spend it somewhere else.

The binding has to be cryptographic and it has to be checked at the moment the action executes. The proposed action is hashed. The grant is signed over that hash. The governor releases the action only if the hash of what is about to run matches the hash the reviewer signed. An action that drifted between the review and the execution does not match, and does not run.

That construction also makes the grant consumable. A grant bound to one action hash is spent when that action runs. It cannot be replayed against a second action, because the second action hashes differently. Single use falls out of the binding rather than being enforced by a separate rule.

The reviewer acts under an envelope too.

Once the override is a grant, the party issuing it is exercising authority, and authority is the thing this architecture governs. The reviewer is not outside the control loop. They are a participant in it, and their act is subject to the same questions the agent's act is.

Was this reviewer authorized to grant authority at this level, for this class of action? A reviewer cleared for one tier of consequence cannot lift an agent above that tier. The grant record has to show the reviewer's own envelope, not just their name, or the examiner cannot tell an authorized grant from a click by whoever was on shift.

Separation of duties applies here without modification. The party that proposed the action cannot be the party that grants the authority to run it. When the agent escalates to a reviewer whose approval the agent itself summarized, framed, and recommended, the concurrence is thinner than the record makes it look.

Why an examiner asks now.

SR 26-2 took effect on April 17, 2026 and placed agentic AI outside its scope, pointing institutions back at their own risk practices while an interagency RFI on AI is still forthcoming. EU high-risk obligations sit at December 2, 2027 for standalone systems and August 2, 2028 for embedded ones. China's implementation opinions on intelligent agents became enforceable on July 15, 2026 and set out a tiered decision-authorization framework with filing obligations in high-risk sectors, which makes the authorization level of an agent decision a thing a regulator now expects to be declared.

The dates differ. The question at the end does not. The examiner pulls one action and asks what authority governed it. When the answer is that a human approved it, the follow-up is immediate. What did they grant, over what, and for how long. A timestamp and a name do not answer it.

What we are building.

Wayfinder Systems Group treats every restoration of authority as a signed grant rather than an approval event. The grant names the reviewer, the reviewer's own envelope, the action hash it is bound to, the level authority rises to, and the point it lapses. It is sealed onto a tamper-evident chain before the action it releases is allowed to run, and it is spent when that action runs. Patents held in The Wayfinder Trust. We call her Velma.