Every action an AI system takes should trace to a human who accepted responsibility for it. Most can't. That is the gap.
Ask a simple question of any agentic AI deployment: when it did the thing, on whose authority? Follow the answer back. In most systems the trail runs a few hops — a prompt, a config, a service account — and then goes dark. Somewhere in the middle, authority appears from nowhere. The agent was allowed to act because it was allowed to act.
That is a bootstrapped authority, and a bootstrapped authority is a liability with no owner. When it goes wrong — and at machine speed it will eventually go wrong — there is no name at the end of the chain. Just a system that decided it was permitted.
We take the opposite position as an invariant: no authorization is self-bootstrapped. Every authorization in the system derives, traceably, from a human act of accepting responsibility.
Two ways authority can be legitimate
There are exactly two admissible origins for any action's authority, and every action must resolve to one of them:
- Direct human attestation. A person, identified and accountable, authorized this specific action or class of action. Call that set H.
- Policy-delegated authority. A person wrote a policy — also an act of attestation — and this action was generated from that policy within its stated scope. Call that generated-from(HP).
Every authorization the system will ever issue lives in H ∪ generated-from(HP). There is no third door. There is no "the agent decided," no "the orchestration layer granted it," no emergent permission that traces to no one. If an action cannot be resolved to a human attestation — direct or through a policy a human signed — it is not admissible. It does not run.
Authority is not something a system has. It is something a person lent it, on the record, and can be shown to have lent it.
Why the provenance chain is the whole product
This sounds like plumbing. It is the load-bearing wall.
The reason institutions cannot deploy autonomous AI into anything consequential is not that the model is weak. It is that liability has nowhere to attach. Insurance needs a named party. Regulators need a responsible officer. A courtroom needs a person who decided. An architecture where authority appears from nowhere offers all three of them the same answer — nobody — and nobody is not an answer any of them will accept.
Make the provenance chain explicit and unbroken, and the picture inverts:
- The underwriter can price the deployment, because every effect maps to an attested grant with a known holder.
- The compliance officer can attest to the system, because "who authorized this?" has an answer for every action, not most of them.
- The general counsel can defend it, because the record shows a human in the loop of authority — not necessarily in the loop of every keystroke, but in the loop of permission.
The point is not to slow the machine down by dragging a person into every decision. Existing authority executes its scope at full speed. The point is that the scope itself was drawn by a human who can be named, and that the drawing is on the record.
The discipline this imposes on us
An invariant is only worth stating if you refuse to break it under pressure. So: there is no admin override that mints authority from nothing. There is no "trusted" internal service that gets to skip the chain. There is no bootstrap account whose permissions trace to the fact that it is the bootstrap account. Every one of those is the same failure wearing a different badge — authority that answers to no person.
Hold the line and you get a property nobody else in this market is offering: an AI system where you can point at any action it ever took and follow the authority home, all the way to a human who accepted responsibility for it. Not by faith. By sight.
Reference invariants: ZTG-0d (Identity Integrity), ZTG-1 (Mechanistic Boundary), ZTG-4 (Evidence-Coupled Execution).