Authority needs an effect, an owner, and an expiry

Specify the proposed effect

An agent may draft an email, approve a refund, change an access rule, or publish a document. Each action changes a different object and affects different people. Approval should identify the exact action, target, data, and permitted scope.

If any material part changes after approval, the approving person needs a new view of what they are authorizing.

Keep context separate from permission

Background documents help a system understand a task. They do not grant execution rights. The authority record should name its source and accountable owner outside the agent's narrative about what it believes is allowed.

Make refusal useful

An unknown owner, changed recipient, expired approval, or missing evidence should trigger a clear stop with an explanation and a route to a human decision.

This design principle applies whether the agent is customer facing or part of an internal engineering workflow. The exact controls still require implementation and testing in the target environment.