Authorized Actions, Unauthorized Outcomes

Executive abstract

Every call can pass the control, and the outcome can still fail.

An agent-control system can authenticate an agent, verify delegated authority, and approve every individual request under a local policy, yet still authorize an aggregate outcome the enterprise did not intend. The gap appears when decisions are evaluated in isolation across sessions. In the underlying synthetic payment scenario, five sessions each remain below a 1,000 per-session cap, while their combined authorized exposure reaches 4,000 against a 3,000 aggregate risk budget. The issue is not whether a policy evaluator is stateless. A stateless evaluator can enforce an aggregate rule when a trustworthy aggregate is supplied in its decision context. The missing control is an architecture that maintains cross-session exposure, reserves capacity atomically before authorization, manages the reservation lifecycle, and makes that state available to the decision. This brief explains the pattern, its executive implications, and the evidence boundary of the proposed control in systems that delegate authority at scale.

Governance model

Per-call authorization versus sequence-level governance

A composition-aware control needs a shared cross-session risk ledger, atomic reservation before authorization, idempotency and correlation for retries, and a lifecycle for settlement, release, expiry, or cancellation. A naive counter is insufficient under concurrent requests because multiple sessions can evaluate the same pre-commit state. The proposed pattern is reserve-then-authorize.

Executive implications

Three decisions leaders need to make explicitly

1. Define aggregate authority. Per-action limits do not automatically represent an enterprise risk budget. Name the aggregate that matters: spend, exposure, inventory, privilege, or another constrained resource.
2. Make the control architectural. A policy rule cannot reconstruct trustworthy cross-session state by itself. Decide which service owns the ledger, reservation semantics, reconciliation, and evidence record.
3. Require evidence of composition. An allow or deny verdict alone cannot show how separately authorized actions accumulated. Capture the relevant decisions, aggregate, threshold, and refusal in a replayable record.

Proposed control

Cross-session composition control

The proposed design places an authoritative ledger and atomic reservation step ahead of the final authorization. The control checks remaining aggregate capacity, reserves it if available, presents the updated aggregate to the evaluator, then records whether the action settles, releases, expires, or is canceled. This does not replace identity, delegation, or per-call policy. It governs what their individually permitted decisions compose into.

1. Read authoritative aggregate exposure. Start with the current committed and reserved exposure for the governed resource.
2. Reserve capacity atomically. Create a durable reservation before final authorization so concurrent sessions cannot rely on the same remaining capacity.
3. Evaluate with the updated aggregate. Present the post-reservation state to the policy evaluator with the relevant correlation and authority context.
4. Settle, release, expire, or cancel the reservation. Close the reservation lifecycle and preserve the record required to explain the outcome.

Evidence and limitations

Useful as a design and evaluation reference, not a production claim

• The reference scenario uses five simulated sessions valued at 800 each, a 1,000 per-session cap, and a 3,000 aggregate budget.
• The companion concurrency comparison is simulated in a single-threaded reference implementation. It models the difference between a shared pre-commit snapshot and serialized reservations.
• The included record can be replayed for internal consistency. It is not an independently verifiable, provenance-bound attestation.
• Third-party platform discussion is limited to cited public descriptions and is not an internal audit or exhaustive market survey.

Related research

The connected argument