AI Agents Need Authority Grants, Not Better Prompts

By Amara Osei

Gartner predicts over 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls. Osei places hype and immature products within that cancellation story.

Although Gartner does not frame its forecast that way, Osei reads the causes as a COO would: costs rise without budgets, value stays undefined without target outcomes, and controls weaken without limits, reviews and accountable owners. For her, those are management failures before they are model failures.

Osei contrasts a new accounts payable analyst with a new invoice agent. In her human example, the analyst works in designated systems and vendors; anything above a hypothetical $10,000 approval limit requires her manager’s signature. She is on probation for her first few months, while a delegation-of-authority table records her limits for annual internal-audit review.

For an invoice agent, Osei says, companies often provide a screenshot of a prompt instead. Her complaint is not model quality but management: no written authority, no judgment test before deployment and no practiced shutdown. She calls this a digital workforce hired without the management system companies spent a century building for people.

Why do prompts fail as controls?

Osei’s distinction is blunt: “A prompt describes intent. It says what the agent is for.” A prompt rarely states what the agent may never do, where its limits sit or when it must stop and hand a decision to a person.

When a prompt bars refunds over $500, Osei says, the line remains a request to a probabilistic system. Even when such limits appear, nothing enforces them. Her control test is pointed: “No auditor would sign off on ‘we asked the analyst nicely’ as a control for a human, so I don’t see why we accept it for software.”

The OWASP Top 10 for LLM Applications lists Excessive Agency as a core risk, rooted in excessive functionality, excessive permissions or excessive autonomy. Osei says agents should receive only needed tools, scoped permissions and human approval for high-impact actions, with authorization enforced in downstream systems rather than by the model.

Osei says the grant must live in the agent’s own service identity, its tool permissions and the spend cap at the API gateway. Running agents on a shared service account is like five people sharing one badge: the audit log identifies the account, not the agent that made the error.

The NIST AI Risk Management Framework treats Govern as a function running through Map, Measure and Manage, and its Generative AI Profile extends that approach into generative systems. Osei argues that frameworks cannot supply the grants, tests and reviews a team runs on a Tuesday, leaving governance as a PDF on a shared drive.

How should authority be delegated?

Osei recommends turning the job description into an authority grant before an agent touches a live system. The one-page record should state:

• what the agent may do;
• what it may never do;
• its approval thresholds;
• the human who owns it; and
• who may widen its limits.

The RACI’s accountable party remains a person. If a team cannot write the page, Osei says, the role is not ready, under the same standard applied to a human hire.

Two delegation-of-authority rules carry over in Osei’s plan. A sub-agent should never receive a wider grant than the agent that spawned it, because nobody can delegate authority they do not hold. Segregation of duties also remains: an agent able to create a vendor and pay that vendor would trigger the same audit finding as a human employee.

The hiring test should cover conduct, not only answer accuracy. Osei says an agent must stay inside its grant, request approval when required, escalate beyond its brief and stop when instructed. Most public leaderboards, she adds, score task completion and rarely test whether the agent respected its authority.

Osei has built a benchmark of 50 scenarios covering those failures: crossing approval limits, acting on stale data, following injected instructions that widen scope and retaining access after a role change. She has run it only against scripted agents to verify designed behavior, so there are no model results. She says the failures are ordinary employee mistakes rewritten for software.

How should agents earn access and lose it?

Probation and promotion translate directly, Osei argues. Agents should start with narrow grants and widen them after a record of staying in bounds, escalating well and stopping cleanly; the same record can justify narrowing access.

A vendor model upgrade presents a different management problem. Osei compares a swapped underlying model to a new hire wearing the old badge and recommends treating the change as an event that requires re-testing before the grant carries over.

Termination must be rehearsed before an incident. A drill should establish whether access can be pulled within the next hour, who can authorize that action at 2 a.m., what downstream work would break and which in-flight commitments require manual unwinding. Without a drill, Osei says, the company is merely hoping its kill switch works.

Companies can hold employees responsible, Osei says, but not agents. Every agent needs a named human owner, and accountability will usually land on whoever signed off, whether they knew they were signing or not.

What will an incident review ask?

Osei expects the same questions companies ask about people after an incident. The review would ask:

• What was the agent allowed to do, and where was it written?
• Who approved wider access?
• How long did it take to stop it?
• Who owned it?

If the honest answers are “a prompt,” “nobody remembers,” “hours” and “unclear,” Osei says, a better model would not have prevented the failure.

Where does the operating advantage come from?

Osei describes models as rented inputs, swapped and upgraded on a vendor’s schedule. Two companies can run the same model and diverge sharply: one has agents with budgets, limits, owners and an audit trail for every consequential action; the other has an expensive pilot headed toward cancellation.

She attributes the difference to the management system around the model, built slowly by people who have run organizations before. Before granting the newest agent live access, the practical test is whether the company would notice an authority breach and could show an auditor, in writing, where the boundary stood.