Inference-Delegated Authorization is a structural anti-pattern in which the model's output is used to determine whether an action is permitted, rather than separating the inference layer from the authorization layer. The pattern is characterized by:
This pattern concerns the architectural coupling between inference and authorization, not model capability.
- Authorization boundaries that are functions of model behavior rather than policy specification.
- Governance constraints that change implicitly with model updates, fine-tuning, or provider changes.
- No invariant definition of permitted actions that exists independent of inference.
- No mechanism to audit authorization decisions without reproducing exact model state.
The mechanism typically manifests through:
The mechanism delegates the authorization function to the same computational process that performs inference. The model becomes both the proposer of actions and the authorizer of actions.
- Model-based classifiers that gate execution based on output classification.
- Confidence thresholds where actions proceed if model confidence exceeds a boundary.
- Model-provided "safe/unsafe" or "approved/rejected" ratings treated as authorization signals.
- Agentic systems where the model itself decides what actions it is permitted to take.
The governance boundary is not specified — it is discovered.
When authorization is delegated to inference, no one can state precisely what actions are permitted. The authorization boundary is: • Implicit in model weights, training data, and fine-tuning. • Discoverable only through empirical probing. • Subject to change without notice when models are updated. • Potentially different across model versions, providers, or deployment configurations.
Organizations cannot write authorization policies because the authorization function is not under their control.
Model updates become governance changes without governance review.
The structure creates silent policy drift: From: "Actions of type X are prohibited by policy P, enforced by mechanism M." To: "Actions of type X were rejected by model version V; behavior under V+1 is unknown."
When the model changes, the governance boundary changes. This occurs without policy review, change management, or notification. The organization discovers its new authorization policy through user reports or incident response.
COUNTER-PATTERN: Authorization Layer Independence
Authorization must be evaluated by a layer that is independent of inference. The authorization layer must: • Implement explicitly specified policies that exist as reviewable artifacts. • Produce identical decisions regardless of which model provides inference. • Be modifiable only through governed change management processes. • Support verification that a given action was authorized according to stated policy.
The model may suggest actions. A separate, deterministic layer must authorize them.
Inference-Delegated Authorization couples the governance boundary to model behavior. The resulting system cannot maintain stable authorization policies across model updates and cannot support governance review of authorization changes.