When software acts, authority must be provable.
AI agents don’t fit permission models built for humans: they act at machine speed, on delegated authority, across records no one enumerated in advance. B5 Secure’s answer is architectural — an agent is a first-class actor whose delegation chain is part of every decision: who delegated, what scope, when it expires, and the rule that scope can only narrow, never widen, hop by hop.
Every agent action is a data-element decision with evidence. An agent that reaches beyond its profile isn’t quietly helped along — it’s stopped, with a reason code, on the record.
The platform’s invariants apply identically to human, service, and agent actors: deny-overrides by construction, no unrecorded allows, and a reason code for every outcome.
The AI-agent authorization capability is in active development as part of the B5 4.0 program.
1. Why human permission models fail for agents
A role works because a person has a job. They act a few hundred times a day, inside a context their colleagues can reconstruct, and if they do something strange somebody notices within hours. None of that is true of an agent. It acts thousands of times an hour, on authority someone else delegated, across records nobody enumerated in advance, and the first evidence of a problem is usually the outcome.
So the questions change. Not what may this identity access, but what may this agent do, on whose behalf, for what stated purpose, up to what limit, and until when — and the answer has to be enforced where the action executes, not at the door it came through.
2. The four things a grant to an agent must carry
A sponsor
A human or an accountable service whose authority the agent is exercising. An agent with no sponsor is an orphan process with credentials.
A declared purpose
Recorded when the grant is made, not inferred afterwards. Purpose written after the fact is narration, not authority.
A scope
Which records, which fields, which operations. Read access to an account is not permission to move value out of it.
A limit and an expiry
An aggregate the agent cannot exceed and a time after which the grant is simply gone.
Identity platforms can now give an agent an identity, and that is genuinely useful — it answers who is calling. It does not evaluate whether this action, on this record, for this purpose, is inside the agent’s remit. That evaluation is the product.
3. The AND-gate: agent and sponsor must both allow
The failure mode people worry about is an agent doing something its sponsor never could. The failure mode that actually happens is subtler: an agent doing something its sponsor could do, but did not intend to delegate. Both are prevented by the same rule — an agent may act only where the agent’s grant and the sponsor’s own authority both permit it, per data element, fail-closed. Neither alone is sufficient, and the intersection is checked at the method.
An agent that inherits its sponsor’s full authority is not delegation. It is impersonation with better logging.
4. Withdrawing authority from something that does not stop
Revoking a person’s access works because people stop. An agent mid-task does not. So the important question is what happens to the instruction that has already been accepted and has not yet completed.
The default is that it fails. If an agent’s credentials have been compromised, the instruction already moving is precisely the one you need stopped, and “held pending resolution” is not stopped. An in-flight instruction completes only if the grant’s owner elected that in advance, with a checkbox they ticked themselves — never inherited, never set by an operator, and never turned on by the agent.
5. What you show the person who asks
Every decision produces a record naming the agent, its sponsor, the declared purpose, the record acted on, the grant in force, the limit consumed, the reason code and the timestamp. Those records are signed and hash-chained, and they verify offline — by someone who does not trust the system that produced them.
That matters sooner than most teams expect. The first serious question about an agent programme is rarely “is it working”. It is “show me what it was allowed to do, and prove nothing else happened.”
6. Where to start this quarter
Not with the whole estate. Start with the one agent that performs entitlement checks or moves value, because that is where an ungoverned grant costs the most, and because it is small enough to finish. Put a sponsor, a purpose, a scope and a limit on it, enforce the intersection at the method, and export a week of decisions. If the export verifies, you have a pattern you can apply to the next fifty.
Bring one agent under governed authority.
A 30-minute technical review of a single agent workflow: its sponsor, its scope, its limits, and the evidence it would produce. No slideware — we look at your call path.