Almost every agent system in production today expresses what an agent may do as a set of permissions attached to a credential. That is the natural thing to build, because it is how we have secured software for thirty years, and it is the wrong primitive for an actor that operates on someone's behalf.

What a permission says

A permission is a statement about reach: this identity can call this API, read this table, write this record. It answers can it. It is evaluated against an identity, and identities are long-lived by design.

The classic failure follows directly. An agent is given a service account. The service account accumulates the union of every permission any workflow ever needed. The agent is now technically capable of far more than anyone intended, and the record of what was intended does not exist anywhere in the system.

What an entitlement says

An entitlement is a statement about authority: this principal granted this agent the ability to take this class of action, within these limits, for this period, for this purpose. It answers may it, and on whose word.

Four properties do the work:

  • A grantor. A named human or governing body who is accountable for the grant. Not a team, not a system — a party who can be asked why.
  • A scope expressed in business terms. "Adjust credit limits up to $5,000 for accounts in good standing" is auditable. "POST /accounts/*" is not.
  • Constraints that travel with the action. Value ceilings, rate limits, data classification, jurisdiction, approval thresholds — evaluated at execution, not assumed at design time.
  • A validity window. Authority that never expires is authority nobody re-examines.

Why this is the load-bearing layer

Everything downstream depends on it. Policy enforcement needs a reference standard to enforce against — without an expressed authority, enforcement degrades to blocking obviously bad requests. Attestation needs something to attest to; "the action succeeded" is not evidence of conformance. Model risk validation needs a defined intended use, and for an agent the intended use is precisely its authority.

You cannot evidence conformance to an authority you never expressed.

The migration is smaller than it looks

This does not mean replacing your IAM estate. Entitlements sit above it: the identity layer still answers can this service reach that system, while the entitlement layer answers whether this particular action, right now, falls inside a grant someone made. Most organisations can express their first meaningful entitlement model in weeks — the hard part is not technical, it is getting the business to state authority explicitly for the first time.

That conversation is uncomfortable and it is the whole point. If nobody in the organisation is willing to put their name to what the agent may do, that is not a documentation gap. That is the finding.