Controlled AI agents need clear authority
An agent can interpret an order, gather information and prepare a change. When that becomes a transaction or a message to a customer, another question matters: who authorised this action, and under which conditions?
At a glance
- 01
Grant authority for specific tasks and actions.
- 02
Bind approval to the transaction that was reviewed.
- 03
Include stopping, handover and recovery in the product.
A task does not grant unlimited authority
OWASP identifies identity and privilege abuse as risks for agentic applications. This raises a practical implementation question: which identity performs each step, and with what permissions?
Our illustrative case is an agent handling incoming order amendments. It may read the relevant order, capture a proposed quantity and prepare the implications for review. That does not grant permission to change customer records or browse unrelated orders. A narrowly scoped connection is easier to explain and examine. Delegation also needs explicit limits: passing a task to another agent should not create additional authority. Responsibility should remain traceable all the way to the final transaction.
From intent to an authorised action
At every step: traceable identity, inputs, tool call and result.
Approve a specific change
OWASP recommends enforcing authorisation in downstream systems and requiring human approval before high-impact actions. The language model alone cannot provide a dependable permission check.
For our order amendment, the review should show the previous and proposed states, affected items and unresolved assumptions. The responsible person approves that proposal. If a colleague changes the order meanwhile, execution must account for the new state and seek another review where necessary. A broad “allow agent” button explains neither the subject nor the scope of consent. A clear comparison reduces questions and shows the business decision the person is taking. Preparation can accelerate while responsibility remains assigned.
Sources: OWASP: Excessive Agency
Make a handover useful
The NIST AI RMF Playbook addresses recovery, intervention and deactivation of unsuitable systems. Our design implication is to define a practical fallback when mapping the workflow.
Suppose the connection fails after the agent submits a transaction. Its status is now uncertain, and repeating it could apply the amendment twice. In this example, the responsible clerk needs a handover containing the transaction identifier, last confirmed state and outstanding check. Reconciliation establishes whether the change happened. If a delivery commitment is missing, the amendment remains a draft. A person should be able to resume it without reconstructing the entire exchange. A technical interruption then becomes a manageable business case. The handover also needs a reachable owner and a due time so that an unresolved order does not disappear into the daily workload.
Sources: NIST AI RMF Playbook: Manage
Readiness appears in difficult cases
NIST recommends documented evaluation under conditions resembling deployment and continued observation during operation. For an agent, that means examining complete workflows, including tools and handovers.
A useful pilot therefore tests similar order numbers, conflicting quantities, withdrawn permissions and delayed system responses. Evaluation covers business correctness, unauthorised actions, necessary corrections and the effort required to finish a case. A correctly rejected amendment can be a better result than a quickly posted mistake. NyxAI connects sovereign AI with these bounded applications. Data handling, operational ownership and approvals are established for the pilot. Expanding the scope of action then requires evidence for the additional responsibilities.
Sources: NIST AI RMF Playbook: Measure
Your next step
Define a bounded application
Start with one concrete workflow, clear ownership and understandable criteria for operation.
Explore the agent pilotSources & further reading
- OWASP: Top 10 for Agentic Applications 2026
Especially ASI03: Identity and Privilege Abuse.
- OWASP: Excessive Agency
Authorisation and approval of high-impact actions.
- NIST AI RMF Playbook: Manage
Recovery and intervention mechanisms.
- NIST AI RMF Playbook: Measure
Evaluation in realistic conditions and operational monitoring.