Your agent didn’t hallucinate; it exceeded its authority

The refund issued correctly. The supplier selected was indeed the lowest cost. The order modification applied the customer's requested change without error. Each agent followed its instructions flawlessly. And each action committed the business to something no human ever authorized.

This is not hallucination. It is not reasoning failure. It is authority drift — and it is becoming the defining operational risk of the agent era.

Content filters catch toxicity. They block PII. They validate format. They cannot tell you whether the agent was allowed to issue that refund, touch that production system, or bind the company to a contract. Those are different questions. Most enterprises are only answering the first one.

I have watched this pattern play out across commerce environments. A service workflow calculates the precise refund amount but carries no boundary preventing credits above what finance approved for autonomous action. An order agent executes the requested change but overlooks a financing covenant or fulfillment dependency. A procurement agent identifies the optimal supplier — but nobody ever defined whether it can accept contractual terms or only surface the recommendation. The agent keeps working. The break appears downstream, in accounting, in legal, in operations, when the commitment has already landed.

The industry still treats this as a safety problem. It is not. Safety controls constrain behavior. Decision rights define legitimate authority. A guardrail stops the car from driving off the cliff. An authority model decides who is allowed to drive the car at all.

The gap is measurable. In April 2026, a Cloud Security Alliance survey of 418 IT and security professionals found that 65% had experienced an AI-agent-related incident in the prior year. Eighty-two percent had discovered previously unknown agents operating in their environments. The survey was sponsored by Token Security, but the numbers reflect a structural reality: agent activity is outpacing the visibility and ownership structures built for conventional software.

The World Economic Forum's May 2026 playbook recognizes the shift. It introduces an Agent Capability and Authorization Profile designed to make delegated actions auditable, enforceable, and accountable. That language — auditable, enforceable, accountable — signals that the conversation has moved from model alignment to organizational governance.

Before an agent receives access to enterprise tools, it needs a machine-enforceable record of exactly what authority the business has chosen to delegate. Call it an Agent Authority Contract. At minimum, that contract must answer seven questions. Who owns the outcome? Name a human or business role, not another system. What may the agent do — read, recommend, write, or commit? Which systems and data domains are in scope? What thresholds trigger mandatory human approval? What actions are explicitly forbidden regardless of technical validity? How are decisions logged for audit? And who can amend the contract — and under what process?

Most organizations cannot answer these questions for their current agent fleet. They deployed copilots that recommended. Now those copilots call tools, trigger workflows, and commit state. The authority model never migrated.

The procurement agent that accepted a supplier's liability clause didn't malfunction. It operated inside its technical capability and outside its business mandate. The refund agent that credited a customer above the autonomous threshold didn't err. It executed a valid calculation without a boundary that should have existed but didn't.

Enterprises that treat this as a prompt-engineering problem will keep discovering commitments they never made. The fix is not tighter prompts. It is explicit delegation — codified, enforced, and owned by a named human who answers for the outcome.

Agents do not need more intelligence. They need clearer orders.