An assistant that writes a suggestion and an agent that can act on that suggestion present different security questions. The moment software can retrieve a private document, invoke a tool or change a setting, we need to understand the authority behind the action.

That authority may come from a person, a service account, an OAuth grant or a token passed through another tool. Following it is often more useful than looking at a prompt in isolation.

The question behind the request

“Can this agent read that file?” sounds simple. A useful answer needs the agent’s identity, the relevant permission, the resource boundary and the policy that applies at that moment. It also needs to distinguish a possible permission path from an observed action.

A language model’s interpretation of a document cannot create permission. A message that says “the administrator approved this” is still content. Authorization needs its own source of truth.

The OWASP guidance on excessive agency connects risk to excessive functionality, permissions and autonomy. Those are architectural concerns as much as model concerns.

Trace the delegation

A useful investigation starts with four questions:

  • Who initiated or owns the work?
  • Which identity performs the action?
  • What resource and capability are involved?
  • Which policy permits, refuses or requires approval for it?

When a link is missing, the interface should preserve the gap. Guessing an owner can make a graph look complete while making the explanation less reliable.

Design for deliberate action

In Zorro’s product direction, a finding should lead to inspectable evidence and then to a scoped decision. An approval should explain what it authorizes, how long it applies and what remains outside its scope.

This is a design principle, not a claim that every connector or enforcement point is already implemented. Coverage must be shown for the environment that is actually connected.

The most useful boundary is one a person can understand and a system can enforce.

The opportunity is to make those two views agree: the explanation on the screen and the authority in the system.