AI agents now act for companies. They buy, book, change records and call paid services, often at businesses that have never dealt with the company they act for. Knowing who an agent is doesn't tell you what it's allowed to do. These six principles describe what it takes for "allowed" to mean something when the one acting is software.
They are free to use. Anyone may adopt them, adapt them or build to them.
1Write the permission down.
The company an agent acts for states what the agent may do, on its own, instead of letting it follow from who the agent is.
Why: a real agent from a real company can still do something that company never approved. Logins and job titles stood in for permission when a person was present at every act. With agents, no one is.
2Permit the act, not the actor.
Each permission is as narrow as the work: which actions, how much, with whom, and until when.
Why: the risk sits in the act. Broad, open-ended access means one misread instruction can do anything that access allows.
3The business that takes the risk checks, before it acts.
The seller, service or tool that will carry out the act asks whether it's allowed, every time, before doing it.
Why: an agent can't be its own check, because it can be mistaken or talked into things. A review after the fact is an investigation, not a control.
4One step stops it, wherever it's checked.
When a company withdraws a permission, one step is enough, and every business that checks sees it from then on.
Why: stopping an agent shouldn't mean phoning each vendor or cancelling a shared card.
5Anyone can prove it later.
Every answer, yes or no, leaves a signed record that both sides, and anyone they show it to, can check for themselves.
Why: disputes come months later, between parties that don't trust each other's logs.
6When in doubt, no.
If the answer is unknown, missing, unclear or can't be reached, the answer is no.
Why: a check that says yes when it isn't sure isn't a check.
Why these hold as agents get smarter
The usual ways to keep an agent in bounds are to tell it, to watch it, or to have another model judge it. All three get weaker as agents get more capable and more numerous. A permission the company signs, checked by someone other than the agent before the act, doesn't depend on the agent at all.
An agent can talk its way past an instruction. It can't talk its way past a signature.
Reuse
The six principles above are published under the Creative Commons Attribution 4.0 International license (CC BY 4.0). You may copy, share, translate and adapt them, including for commercial use, as long as you give credit: "The Authority Principles" by Inam Haq, delegus.ai/principles, and say whether you changed them.
How Delegus meets the principles, and where it doesn't yet
Delegus is the company that wrote these principles down, so it should be held to them first. This is where the Delegus service and its published specification (v0.2) stand today.
1. Write the permission down.
- Meets it: the company signs a permission for its agent, separate from the agent's identity. The business checks that permission, not the agent's login.
- Not yet: Delegus confirms that a company controls its web domain. That isn't the same as confirming who the company is, so a company using a lookalike domain could register.
2. Permit the act, not the actor.
- Meets it: a permission names actions from a fixed list, a limit on each order, optionally which items and which businesses, and an end date no more than 90 days after it starts.
- Not yet: limits apply to each order. Delegus doesn't keep a running total across orders, so an agent can repeat orders that are each within the limit. And the check is only as precise as the action's description; an action described loosely can fit a permission it shouldn't.
3. The business that takes the risk checks, before it acts.
- Meets it: the business makes one call before it acts and gets allowed or refused, with the reason.
- Not yet: it only protects at businesses that make the check. A business that doesn't check isn't covered, and the agent's company can't make it check.
4. One step stops it, wherever it's checked.
- Meets it: the specification requires that Delegus confirm a revoke only once every later check will see it.
- Not yet: businesses that don't check don't see it. And anyone who steals an agent's private key can act within that agent's permission until the permission is revoked or ends.
5. Anyone can prove it later.
- Meets it: every decision, allowed or refused, comes with a signed receipt that records the documents it relied on by their fingerprint. Anyone holding the receipt and the documents it names can re-check it on their own machine, as of the time it was made. The rules are public: 36 open test cases, which the reference engine passes. In production, evidence is kept under a seven-year lock: once stored, no one, including Delegus, can delete or alter it for seven years.
- Not yet: four checks rest on Delegus's own records: that the company is registered, that it controls its domain, that its key hasn't been reported compromised, and that the request isn't a replay. Anyone can confirm that Delegus signed those results, but not re-run them without Delegus.
6. When in doubt, no.
- Meets it: anything unknown, missing, unclear or unavailable is refused, or returns an error. It never returns an allow.
- Worth knowing: if Delegus can't be reached, the answer is no, and the business decides what "no" means for it: refuse, hold or try again. And Delegus checks what a company allowed, not why: if a company deliberately permits something harmful, the check will allow it.
The specification is public, including its full list of what it doesn't protect against.