The agent still holds the credential.
The decision no longer stands.
An earlier analysis in this space dealt with who is named to oversee AI at board level, and with the record that has to exist before anyone asks. Another dealt with approvers who ratify without deciding, and leave a trail identical to that of someone who decides. This one deals with the next rung: the authorisation that oversight grants, and the instant it stops being valid.
The control that looks closed.
At ten in the morning, a procurement agent receives authorisation to place orders up to a defined ceiling. At ten fifteen, the department budget is frozen. Or the supplier goes under review. Or a second agent has already executed the same order.
The credential is still active. The policy still permits that amount. The approval is on record, it was obtained before the action, and whoever approved had access to the data, authority to refuse and no practical cost in refusing. Every control governance asked for is installed and evidenced.
And that purchase is no longer warranted.
Authorisation is a technical property the agent retains. Legitimacy depends on context, and the context has moved. The two were the same thing while the machine only recommended, because a recommendation has no instant of consequence. They separate when the machine executes.
Order and validity are two questions.
The rule most organisations installed says that irreversible actions require approval prior to the action. It is a good rule and it solves a real problem.
It fixes where the approval enters the flow. It says nothing about the approval remaining true when the action executes.
The operational consequence is that the audit trail does not distinguish the two states. A valid approval and a lapsed approval appear in the record in the same form: a timestamp, a named person, an action that followed. There is no field that separates them and no alert that fires. The difference surfaces in the incident review, when it no longer changes what was executed.
That is why the failure passes audit: what ends up on record has the exact shape of a control that worked.
Four institutions, the same gap.
Between August 2025 and May 2026, four institutions with very different incentives arrived at the same place by their own routes.
| Institution | What it is | What it asks for | Date |
|---|---|---|---|
| CoSAI | Open project of OASIS, brings together technology and security companies | Validate identity and credentials at every critical operation; enforce policy at each hop of the chain and at the endpoint, not only at the entry gate | March 2026 |
| IMDA (Singapore) | Regulatory agency | Record the identity of the agent according to the capacity in which it acts, on its own behalf or on behalf of someone, for audit purposes | Updated May 2026 |
| Academic literature | Work from 2025 and 2026 | Continuous authorisation monitoring, among the components of runtime governance: the decision that occurs between the intent of the agent and the effect of the action | 2025 to 2026 |
| EY | Global consultancy | Behaviour-based identity management, operating at machine timescale | July 2026 |
The four documents are listed at the end, with the scope of each reading.
The IMDA document carries a deployment case, that of Terminal 3, in which authority is issued per cycle: before each payroll run, the responsible director issues a credential scoped to that cycle, including the transfer ceiling declared explicitly before each execution, and out-of-scope actions are blocked before they execute.
Together, these four documents describe what currently counts as adequate in agentic deployment, and an auditor in a regulated sector puts the question against that description before any rule exists. None of them is binding: they are voluntary, some are recent and the Singapore one is guidance from a foreign regulator.
How we build this into our method.
The Alkemia Enterprise AI framework treats delegation to agents by impact bands, which define how much control each class of action requires. In the high and critical bands, the two tiers where the action requires approval before executing or a decision reserved to a human, the grant carries an explicit time limit and, where the action has magnitude, a declared ceiling; and the premises the approval rested on are re-read at the point where the action executes.
An approval with no declared limit is recorded as indefinite, and that mark is an audit finding. The AI system inventory carries two fields for this: in what capacity the system acts, and where the chain lives that says under whose authority each act was performed.
What can be checked this week.
- A
The grant has a time limit, and the limit is recorded data
An approval with no declared limit is an indefinite approval.
Limited by what is the organisation’s choice: one execution, one cycle, a clock, a task. The framework does not prescribe the mechanism, and that neutrality is deliberate, because token lifetime, policy decision point and signed intent credential resolve the same requirement by different routes, and the choice between them is an architecture decision. What is not a choice is the absence of the limit. Where there is no declared time limit, the record must say so in those words.
- B
The premise is re-read at the point of effect
Whoever grants and whoever executes are rarely the same system.
The check has to happen where the action happens: in the system of record, in the API, in the tool. The gate that granted sits too early in the chain to answer for it. It is the difference between trusting that the authorisation crossed the chain intact and confirming that it still holds at the point of enforcement, the one where the effect is produced. The design has to name which conditions are re-checked: a re-check against conditions nobody enumerated is not a re-check.
- C
The stale-grant rate is the one that informs
A sustained zero admits two readings, and both require a decision.
The metric has a name: stale-grant rate. It is the fraction of high and critical band actions that reach the point of execution with the grant lapsed or the re-check failed. The reading is counter-intuitive and it is worth declaring to the board before someone interprets it alone. A sustained zero, across relevant volume, admits exactly two readings. Either the organisation’s context never changes between approval and execution, a statement someone has to be willing to sign. Or nobody is checking validity. The reading that the system is well calibrated requires the first as its premise.
In an audit, the approval will be there.
Pick an agent in production whose failure would be expensive. Check three things: whether its authorisation has a time limit, whether it has a declared ceiling when the action has magnitude, and whether anything re-reads the premises at the point where the action executes. The test runs entirely in-house, and the result stays with whoever ran it.
Discuss your decisioncontact@alkemia.io
Four documents, with the scope of each reading.
- CoSAI (OASIS), Agentic Identity and Access Management v1.0, 20 March 2026, full document
- IMDA Singapore, Model AI Governance Framework for Agentic AI, updated 20 May 2026, full document
- MI9, An Integrated Runtime Governance Framework for Agentic AI, arXiv:2508.03858, abstract only
- EY, Five shifts reshaping the agentic AI economy, July 2026, full document
Agent authority, as a matter of record.
- Is human approval before the action enough to govern an AI agent?
- It fixes where the approval enters the flow and does not say whether the approval was still true when the action executed. A valid approval and a lapsed approval appear in the record in the same form.
- What is runtime governance?
- The decision that occurs between the intent of the agent and the effect of the action. The 2025 and 2026 literature uses the term for the check that has to happen at the moment of execution, in addition to the one that happens before it.
- Are agentic AI governance frameworks mandatory?
- No. The four documents cited in this analysis are voluntary at the date of this reading, and the Singapore one is guidance from a foreign regulator. They describe what counts as adequate in agentic deployment, and it is against that description that an auditor in a regulated sector puts the question before any rule exists.
- Which metric shows whether the check is operating?
- The stale-grant rate: the fraction of high and critical band actions that reach the point of execution with the grant lapsed or the re-check failed. A sustained zero, across relevant volume, admits two readings, and both require a recorded decision.
This analysis offers governance criteria. It is not legal advice and does not determine the compliance of any system.
The instruments cited are voluntary and non-binding at the date of the reading, and the piece does not anticipate whether or when they will become a requirement. The deployment case cited is self-reported by the organisation and published by the regulator, used here as proof that the mechanism exists, not as proof of its effectiveness.