What is execution authority?
The right to act. Before a critical action runs — an agent's purchase, a payment release, an order below your margin floor — something has to decide whether it may proceed and under whose approval. Execution authority names that function, puts it in one place, and records every use of it.
Isn't this just a policy engine?
No. A policy engine answers a question when something asks it. Execution authority owns the moment: the action cannot proceed without it, a human is brought in when the rules require one, and what was permitted is signed so it can be checked later. Teams often run both — rules in a policy engine, authority at the point of execution.
Where does the human fit?
Exactly where the rules say, and nowhere else. Clear cases proceed instantly, which is what keeps systems fast. When policy calls for a person, the action is held and routed to someone with the authority to decide, and their approval is bound to that specific action. Where the rules demand that the approver be shown to be present — not merely logged in — Presence binds the approval to a passkey ceremony on the approver's own device.
Isn't a valid identity enough?
No, and the realistic failure is exactly the one identity cannot see. An agent whose identity is real, whose credential is current and whose API is one it may call can still propose what nobody authorised — because it was steered, because its context lost a constraint, or because the identity itself was taken over. Identity says who is asking; execution authority says whether this exact action, with these parameters, on this target, under this policy, may happen now. As agents decide faster and more autonomously, identity becomes a weaker proxy for authority, which is why the authority is bound to the action and not to the principal: a valid principal with an unauthorized intent is refused or held, and a change to the action after authorization fails the binding. The AgentSafe reference implementation runs that case as its Compromised Principal Test.
Who needs it?
Anyone whose systems act faster than their approvals: teams handing agents real tools and real cards, stores whose pricing automations reach checkout directly, finance ops with payment jobs, and consumers whose assistants can spend for them.
Do we have to write our decisions down for this to work?
No, and that is the point. Approaches that depend on someone maintaining a decision log reliably decay within weeks, because the cost falls on the person making the decision and the benefit lands on someone else later. Decionis writes the record as a side effect of authorizing the action, so a month of running the gate leaves you a decision record nobody had to maintain.
Isn't a rules file — AGENTS.md, CLAUDE.md, .cursorrules — enough?
Those supply context and hope the model follows it. Anthropic's own documentation says Claude treats memory files as "context, not enforced configuration", and that if two rules contradict each other it "may pick one arbitrarily". Execution authority is the other half of that sentence: a deterministic check the action cannot route around, and a signed record of what was permitted.
How is an exercise of authority proven afterwards?
Something always decides — usually a person reading a document, sometimes nothing at all. Execution authority names that function explicitly and puts it in one place, so the answer is deterministic, carries a named approver when policy requires one, and is recorded rather than reconstructed.
