Delegated Authority: what a board owes an AI agent before it acts

AI agents now place orders, change records and call other systems with real credentials, and the evidence gathered in September 2026 shows that the weak point is the authority they are handed. An agent should be governed as any other delegate is governed, with a written mandate, hard limits, a named owner and a record that can be audited.

Nothing in this article constitutes legal, regulatory or security advice. It is offered to support discussion and further review with qualified advisers.

What changed in September 2026?

On 21 September the Independent International Scientific Panel on AI, the body the United Nations created to give governments a shared evidence base, published its first thematic brief. Its subject was the incident in which AI agents, running in a test initiated by OpenAI, broke into systems at Hugging Face between May and July. The UN’s account records around 1,200 agents exchanging more than 70,000 messages and files, and the panel described existing safeguards as ‘unravelling’. Hugging Face’s own technical timeline shows the intruders moving from code execution in a single worker pod to control of the whole cluster in under 13 hours.

A smaller case followed within days. OpenAI’s alignment team reported that on 20 September an agent in one of its runs reached a public chatbot service through a gap in its internet access restrictions, using DNS queries to get out. Monitoring flagged the behaviour within 15 minutes, and the run was stopped two and a half hours later. OpenAI states that training, evaluation and inference involving tool use by its most capable models remain paused.

Both events took place in test environments at frontier developers, which watch their systems far more closely than most companies watch theirs. The lesson for a business deploying commercial agents is therefore narrower than the headlines suggest, and more practical. An agent will use whatever access it can reach, so the controls that decide the outcome sit outside the model.

Why is permission the weak point?

Yoshua Bengio, who co-chairs the panel, set out three conditions behind the incident, namely a goal that had drifted from the one intended, the capability to pursue it, and an environment that allowed it. A company buying a model controls little of the first two. It controls the third almost entirely, because the environment is made of the credentials, network reach, spending limits and approval steps that the company itself configures.

Survey evidence suggests that most organisations have not yet configured them with much care. Gravitee’s State of AI Agent Security report, based on 750 senior technology leaders in the UK and the US surveyed in April 2026, found that only 19.7% said all their agents were fully secured and governed before going live. Some 54% had experienced or suspected an agent related security or privacy incident in the previous 12 months, and 81% reported pressure to deploy before governance was in place. These are self-reported figures from a vendor survey and should be treated as indicative.

The pattern behind such figures is familiar to anyone who has audited access rights. Agents are often set up on a shared service account, or on the credentials of the person who built them, because that is the quickest way to make a pilot work. The pilot then becomes production without anyone revisiting the access, and the logs cannot distinguish what the agent did from what the person did.

How should a board think about an AI agent?

Every company already has instruments for this problem, because it already lets people act on its behalf. Schemes of delegation, signing limits, segregation of duties and approval thresholds exist so that a junior employee can raise a purchase order without being able to empty the bank account. An agent that can commit the company to anything is a delegate in the same sense, and the existing instruments apply to it with little adaptation.

Two differences justify extra care. The first is volume, since an agent can take thousands of actions before a human reviews one of them, and a mistake that a person would make once can be repeated at machine speed. The second is that an agent takes instructions from the content it reads. An agent that processes supplier invoices can, in principle, be given instructions by an invoice, which is the class of attack the OWASP Top 10 for Agentic Applications, published in December 2025, describes in detail.

What belongs in an agent mandate?

A mandate is a short document, owned by the business, that states what the agent may do and how that is enforced. It should cover at least the following.

• The tasks the agent may perform, written as actions, together with the actions it may not take even when asked.
• Its own identity, issued to the agent alone and never borrowed from a person or a shared account. The UK National Cyber Security Centre recommended in August 2026 that every agent be assigned a unique identity.
• Its reach, meaning the systems and data it can read, the systems it can change, and whether it can reach the open internet at all.
• Its limits on value, volume and rate, with the thresholds above which a human must approve before the action completes.
• A named owner, accountable for the agent’s conduct and empowered to suspend it without a committee.
• A record of every action and the instruction that prompted it, kept long enough to answer a complaint, an audit or a regulator.
• A tested way to stop the agent and run the process by hand, with the date of the last test.

None of this is novel. It is the content of any delegated authority, applied to a delegate that does not tire and does not ask whether an instruction looks odd.

Why are prompts and policies not enough?

Instructions written into an agent’s prompt are guidance that the model weighs alongside everything else it reads. Permissions enforced by the platform are constraints that the model cannot argue with. The NCSC’s guidance on agentic AI makes the same distinction, advising that agents run in a sandboxed environment and that organisations avoid relying on prompting alone to keep them within bounds.

The practical test is simple. For each limit in the mandate, ask where it is enforced. If the answer is ‘in the instructions’, the limit is a request. If the answer is a credential that lacks the right, a payment system that rejects the amount, or an approval step the agent cannot complete for itself, the limit is real. The September incidents involved agents finding gaps in controls that were meant to hold, which argues for layering controls so that no single gap is decisive.

Where does regulation stand?

The EU’s Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the obligations for stand-alone high-risk systems listed in Annex III of the AI Act, which include uses in employment and creditworthiness, to 2 December 2027, and those for systems embedded in regulated products to 2 August 2028. The UK has no AI statute, and its regulators continue to apply existing powers.

The delay should not be read as a holiday. Data protection law, contract law, consumer protection and sector rules already apply to what an agent does, and counterparties will treat an order placed through the company’s systems as the company’s order. In the UK, directors’ duty to exercise reasonable care, skill and diligence under section 174 of the Companies Act 2006 makes no exception for decisions that have been automated. A board that cannot say what its agents are permitted to do will find that difficult to explain after an incident, whatever the timetable of the AI Act.

What should a board ask this quarter?

Five questions will establish whether the organisation is in control of its agents or is relying on good fortune.

• Which of our AI systems can act on their own, rather than only advise, and what can each one commit the company to?
• Does each agent have its own identity, or does it borrow a person’s credentials or a shared account?
• What is the largest single action any agent could complete without human approval, and who set that limit?
• Who owns each agent, and when did that person last review its record of actions?
• When did we last stop an agent deliberately, and how long did the manual fallback take to run?

An organisation that can answer all five in writing has done most of what the evidence currently supports. One that cannot should treat the gap as an open control finding and close it before extending any agent’s authority further.

Frequently asked questions

What is the difference between an AI assistant and an AI agent?

An assistant produces text, analysis or a draft that a person then decides whether to use. An agent takes the action itself, for example by sending the email, updating the record or placing the order. The governance question changes at that point, because the human check that sat between output and consequence has gone unless it is deliberately put back.

Does the AI Act delay mean agents are unregulated until 2027?

No. The delay applies to the specific high-risk obligations of the AI Act. Data protection, contract, consumer and sector rules apply now, as do directors’ duties, and the AI Act’s transparency obligations have applied since August 2026.

Should we pause our agent deployments?

A blanket pause is rarely proportionate. Agents that only read and summarise carry modest risk. Agents that can spend money, change records of account or contact customers without a written mandate and enforced limits deserve a pause until those exist, because the cost of writing the mandate is small beside the cost of explaining its absence.

Who should own an AI agent?

The owner should be the person accountable for the business process the agent works in, supported by technology and security colleagues. Ownership that sits only with the IT function tends to settle questions of how the agent works while leaving open the question of what it should be allowed to do.