Research Note · August 25, 2026

Agent-Stated Intent Is Not Authority

Why an AI model's account of what it plans to do cannot be the root of permission for the action itself.

The operational question

AI-enabled workflows are moving from recommendations to actions. They can query systems, change records, trigger automation, and coordinate with other AI agents. Before any consequential action occurs, the responsible official still needs a clear answer: is this action authorized now?

A valid identity is necessary. Temporary privilege is safer than standing access. The model's stated intent can help explain a request. None of those facts, alone or together, establishes mission authority.

Intent is an input, not the authority root

An AI model's description of its plan comes from the same system requesting permission. It may be incomplete, mistaken, manipulated by untrusted content, or disconnected from the action arguments that will actually reach a tool.

Authority should come from an external source the AI agent cannot rewrite: approved scope, accountable parties, defined tool and data boundaries, a validity period, human-review requirements, and revocation state.

Bind authority to the requested action

The authority check must evaluate the action that would execute, not only the goal that was described. Tool, arguments, destination, mission, identity, policy version, delegation lineage, and approval state all matter at the decision point.

The result should be understandable: allow the action, deny it, or hold the exact action for a responsible official. A later change to a protected argument should require a new decision.

Delegation must narrow, not expand

A child workflow should not gain authority that its parent did not possess. Its scope should remain at or below the parent boundary, and the lineage should remain inspectable. When parent authority is withdrawn, descendants and queued approvals should not continue under stale permission.

Evidence must survive the workflow

Reviewers need records they can inspect outside the workflow that created them. Each governed decision should preserve what was requested, which authority and policy were evaluated, whether human review occurred, what decision was made, and whether the action was sent.

NeoXFortress produces signed, tamper-evident decision evidence and packages verification material for controlled offline review. This supports an approval decision; it does not replace the responsible official, security assessment, legal review, or authorization process.

Test the boundary, not only the happy path

Authority controls should be challenged with replay, stale approval, revocation, delegated-scope expansion, parameter substitution, alternate tools, bypass attempts, and evidence tampering. A passing result is meaningful only if the test reached the control it claimed to exercise.

Read the proposed 12-test evaluation method · Review the citable public record