AI agents now act for companies. They buy, book, change records and call paid services, often at businesses that have never dealt with the company they act for. Knowing who an agent is doesn't tell you what it's allowed to do. These six principles describe what it takes for "allowed" to mean something when the one acting is software.
They are free to use. Anyone may adopt them, adapt them or build to them.
1Put the authority in writing.
The company an agent acts for states what the agent may do, on its own, instead of letting it follow from who the agent is.
Why: a real agent from a real company can still do something that company never approved. Logins and job titles stood in for authority when a person was present at every act. With agents, no one is.
2Permit the act, not the actor.
Each grant of authority is as narrow as the work: which actions, how much, with whom, and until when.
Why: the risk sits in the act. Broad, open-ended access means one misread instruction can do anything that access allows.
3The business that takes the risk checks, before it acts.
The seller, service or tool that will carry out the act asks whether it's allowed, every time, before doing it.
Why: an agent can't be its own check, because it can be mistaken or talked into things. A review after the fact is an investigation, not a control.
4One step stops it, wherever it's checked.
When a company takes back the authority it gave an agent, one step is enough, and every business that checks sees it from then on.
Why: stopping an agent shouldn't mean phoning each vendor or cancelling a shared card.
5Anyone can check the answer later.
Every answer, yes or no, leaves a signed record that both sides, and anyone they show it to, can check for themselves.
Why: disputes come months later, between parties that don't trust each other's logs.
6When in doubt, no.
If the answer is unknown, missing, unclear or can't be reached, the answer is no.
Why: a check that says yes when it isn't sure isn't a check.
Why these hold as agents get smarter
The usual ways to keep an agent in bounds are to tell it, to watch it, or to have another model judge it. All three get weaker as agents get more capable and more numerous. A grant of authority the company signs, checked by someone other than the agent before the act, doesn't depend on the agent at all.
An agent can talk its way past an instruction. It can't talk its way past a signature.
Reuse
The six principles above are published under the Creative Commons Attribution 4.0 International license (CC BY 4.0). You may copy, share, translate and adapt them, including for commercial use, as long as you give credit: "The Authority Principles" by Inam Haq, delegus.ai/principles, and say whether you changed them.
How Delegus meets the principles, and where it doesn't yet
Delegus is the company that wrote these principles down, so it should be held to them first. This is where the Delegus service and its published specification (v0.3, a release candidate) stand today.
1. Put the authority in writing.
- Meets it: the company signs a grant of authority for its agent, separate from the agent's identity. The business checks that grant, not the agent's login.
- Not yet: Delegus confirms that a company controls its web domain. That isn't the same as confirming who the company is, so a company using a lookalike domain could register.
2. Permit the act, not the actor.
- Meets it: a grant names actions from a fixed list, a limit on each order, optionally which items and which businesses, and an end date no more than 90 days after it starts.
- Meets it (v0.3): a grant can carry a budget across orders (a total, a limit per day, week or month, or a number of uses), spent only after every other check passes.
- Not yet: without a budget, each order is checked on its own, so an agent can repeat orders that are each within the limit. And the check is only as precise as the action's description; an action described loosely can fit inside a grant it shouldn't.
3. The business that takes the risk checks, before it acts.
- Meets it: the business makes one call before it acts and gets allowed or refused, with the reason.
- Not yet: it only protects at businesses that make the check. A business that doesn't check isn't covered, and the agent's company can't make it check.
4. One step stops it, wherever it's checked.
- Meets it: the specification requires that Delegus confirm a revoke only once every later check will see it.
- Not yet: businesses that don't check don't see it. And anyone who steals an agent's private key can act within that agent's authority until the grant is revoked or ends.
5. Anyone can check the answer later.
- Meets it: every decision, allowed or refused, comes with a signed receipt that records the documents it relied on by their fingerprint. Anyone holding the receipt can check it is genuine; the business and the company it names can check what it relied on. The rules are public: 90 open test cases (40 for v0.2, 50 for v0.3), which the reference engine passes. In production, receipts and their evidence are written to a seven-year lock before the answer is returned: no one, including Delegus, can delete or alter them for seven years.
- Not yet: some checks rest on Delegus's own records: that the company is registered and in good standing, that it controls its domain, that its key hasn't been reported compromised, that the request isn't a replay, that a budget still had room when it was spent, and, when a decision relies on an earlier one, that both belong to the same transaction and that the earlier company is still in good standing. Anyone can confirm that Delegus signed those results, but not re-run them without Delegus.
6. When in doubt, no.
- Meets it: anything unknown, missing, unclear or unavailable is refused, or returns an error. It never returns an allow.
- Worth knowing: if Delegus can't be reached, the answer is no, and the business decides what "no" means for it: refuse, hold or try again. And Delegus checks what a company allowed, not why: if a company deliberately permits something harmful, the check will allow it.
The specification is public, including its full list of what it doesn't protect against.
Version 1.1, 24 September 2026: rule 5 reworded from "Anyone can prove it later" to "Anyone can check the answer later". The receipt proves the decision; it doesn't prove the action was right. Nothing else changed. Version 1.0 was published on 23 September 2026.