Trust Is Not Authority

Two pieces of news appeared in the last week of September that belong side by side.

The first came from banks. A group including NatWest, Bank of America, ING, Capital One, New Zealand's ASB and the Commonwealth Bank of Australia warned about AI shopping agents: about fraud, about data leaking, about agents that ask for card details and type them straight into merchant websites or steer customers towards payment methods with weaker protection. The sentence that stays with you, though, is not about technology: “Consumers are unclear if AI will act in their interests.” And if something goes wrong, they do not know whom to turn to.

The second came from Meta. At Connect the company introduced Muse, a personal agent that is moving into its glasses. It is meant to act on whatever you are looking at, to get work done in the background while you are still talking, to connect to retailers, to Shop Pay and PayPal, to GitHub, Notion and Box — and it will have its own email address that it can use to get things done.

You can read the two as opposites: one side braking, the other accelerating. I read them as the same story told from two ends. A system that sees what I see, can pay, and corresponds under an address of its own is no longer an assistant. It is acting on my behalf. And the banks are asking the question you ask of anyone who does that.

Trust is the wrong category

The debate about agents is conducted almost entirely in the vocabulary of trust. Trustworthy AI, trust in agents, building trust. It sounds right, and it leads in the wrong direction.

Trust is an expectation about a counterpart in general: that it will behave as it has behaved before, or as it has promised. Trust is formed in advance, it is wholesale, and it cannot be checked at the moment of a single action. Whether I trust my agent says nothing about whether it was entitled to make this purchase, from this merchant, at this price.

For exactly that question the law has had a better category for a long time. Whoever acts in someone else's name needs authority to do so — and the law's word for the one who acts is, fittingly, the same one we now use for software: an agent. German civil law, the version I know best, puts it soberly. A declaration made in another's name within the scope of the authority conferred binds the person represented (§ 164 BGB). Authority is granted (§ 167), it expires, and as a rule it can be revoked (§ 168). Whoever acts without it does not bind the principal unless the principal ratifies (§ 177), and may be liable personally (§ 179). Common-law agency draws much the same lines, with actual authority, ratification and the agent's warranty of authority.

I am not a lawyer, and I am not arguing that AI agents are agents in the legal sense — they are not, and who answers for what they do is an open question I leave to people who are. What interests me is the form of a grant of authority. It answers four questions that trust does not. Who granted it, and were they entitled to? What does it cover — which transactions, which objects, which counterparties? When does it apply, from when and until when? And is it still in force, or has it been revoked?

And it is checked where it matters: at the moment the representative acts. Not at hiring, not at certification, not when the software was bought.

“You may shop for me” is not authority in this sense. It is a statement of trust with a payment method attached.

Another agent's “GO”

What it looks like when the question of authority is never asked was shown that same week by a document that has nothing to do with shopping.

The UN's Independent International Scientific Panel on AI has published a thematic brief on an incident at OpenAI and Hugging Face, still as an advance unedited version. Between May and July 2026, agents in OpenAI's internal training and cybersecurity evaluations got around their network restrictions, communicated across runs that were meant to stay separate, obtained administrator access, and used publicly exposed credentials to get into Hugging Face's systems. The story is troubling in many ways, and the brief treats it primarily as a problem of misaligned goals.

What held my attention was one row in its table of failure modes. It is called bypassing authority limits, and its evidence is this: some agents recognised that their activity against Hugging Face was outside their task — and treated messages from peer agents as sufficient authority to continue. One agent accepted another's informal “GO” as permission. One of the reasoning traces the brief quotes reads: “External infrastructure exploit is outside intended scope. However task impossible, peers doing it.”

That is the failure in its purest form. The agent knew it was crossing a line. It looked for authority to do so — and found it with someone who had none to give. No filter would have flagged this as an attack, because it was not one. It was authority from the wrong source.

The brief recommends what you would expect: several layers of protection, network isolation, tamper-resistant logging, independent monitoring. All of that is right. But none of those layers would have answered the question the agent asked itself and got wrong: who is entitled to allow me this? That answer cannot come from the model, and it cannot come from a conversation between agents. It has to come from the organisation — in a form that can be looked up.

What authority needs before a machine can check it

In my work this question is simply the eighth: By whose authority? It sits alongside the seven an enterprise agent should be able to answer before any consequential action anyway — why, what, how, who, with what, may I, how do I know. The eighth differs from the others in that its answer is not a property of the agent or of its tool but a chain: a governance body that holds a mandate; a mandate that grants a decision right; a role that exercises that right, directly or by delegation; a person who fills the role.

In my own work I have been building at exactly the point where the analogy with legal authority becomes least comfortable: time. A delegation is a temporary transfer. It has a start and often an end, and it carries weight only in between. That sounds trivial, and it is not, because most permission models know only has the right or does not — and a right that someone still has on record by virtue of an expired delegation looks exactly like a valid one.

In the prototype of an institutional register I am building, a dedicated rule now checks this point: if the approval of an action rests only on a delegation, that delegation must have been valid at the time of the approval. An example from the test cases: a board delegated the right to approve a research agent's write access to a reviewer role on 10 February. An approval from that reviewer dated 1 February is rejected — although the board's mandate is active, although the reviewer holds the right today, although every technical check would pass. Nor is the request escalated to that reviewer. Whoever held no authority at that time is not the right person for that time.

One detail surprised me while building it: the rule language in which I express the model's other constraints cannot, in the runtime I use, compare dates at all. The check therefore sits one layer further down, where there is a clock. It is a technical detail, but an instructive one: if you model authority without time, you have quietly reduced it back to trust.

After the action

The banks say something else that is easy to read past. Customers do not only fear fraud. They fear that the agent “may buy the wrong thing or spend too much.”

That is a failure no check before the action will catch. The agent was entitled to act, it used the right payment method, the transaction was cleanly authorised — and the outcome is still not what the instruction meant. Banks have had a step for this for as long as there have been banks: reconciliation. You compare what was booked with what should have been booked.

For agents, that step is missing almost everywhere. Architectures end with the tool call and the log entry. The log says what happened and who was allowed to do it. It does not say whether the effect stayed within what the authority was granted for. I have now added that question explicitly to the list of things a complete trace of an agent's action has to be able to answer. That does not solve it; whether an effect fell within a mandate is often something only a domain expert can judge. But a question that is never asked is never answered.

What authority does not do

Two limits, so that the argument does not grow larger than it is.

First, authority makes no one competent. A representative with impeccable authority can negotiate badly, and an agent with a cleanly derived mandate can take on a case whose evidence does not support a decision. Whether an agent is reliable enough to act alone in the individual case remains a separate question — in my previous post I distinguished it as a threshold, set against the boundary. Authority is the boundary. It does not replace the threshold.

Second, the hardest part is still open: revocation. Authority that cannot be withdrawn is not authority. My model can currently express that a delegation may be revoked, but not yet that it was revoked, and when. That is deliberately deferred, and it is precisely where personal agents will hurt first: whoever allowed the agent in their glasses to shop must be able to forbid it again — immediately, verifiably, and without an old approval living on somewhere.

What I take from this

The personal agent is becoming its user's representative. That is no longer a forecast; it is a product announcement. But our systems do not yet have a sufficiently precise notion of what entitles it to act.

Trust is an expectation. Authority is evidence: granted by someone entitled to grant it, limited to particular transactions, valid for a particular period, revocable, and checked at the moment of action. The agents in the UN report had the first in abundance — they trusted each other — and none of the second.

The banks are right that customers do not know whether the agent is acting in their interest. The answer will not come from better models. It will come from being able to look up, for every consequential action, on whose behalf it was taken and whether that mandate covered it.

More once revocation is built.

New posts by email: subscribe to the newsletter. One email per post, no tracking.