Topics
The vocabulary of governing AI agents
The security industry has spent twenty years building a vocabulary for humans and service accounts: identity, access, permissions, least privilege. AI agents reuse most of those words and quietly change what they mean. An agent with a valid credential and a valid permission can still make a decision nobody authorized it to make.
These pages define the terms one at a time. Each one starts with a plain definition, works through a concrete example, and ends with where the concept stops and what has to sit next to it. Where we are stating a position rather than a settled definition, we say so.
Authority and governance
Authority governance
Defining what an agent may decide, enforcing it at runtime, and recording who is accountable.
AI agent governance
The controls that determine what agents may do, enforce it while they run, and name who answers.
AI governance
The broad program, and the part of it that has to run in real time once agents take actions.
Authorization at runtime
AI agent authorization
Deciding whether a specific agent action may proceed, beyond what scopes and roles can say.
Runtime authorization
Evaluating each action at the moment it happens, with live context and cumulative state.
AI agent permissions
What an agent can technically do, and the gap between that and what it is allowed to decide.
AI agent least privilege
The minimum authority to complete the task, not just the minimum access.
Delegation
Delegated authority
The mandate a human grants an agent: which decisions, within what limits, under whose accountability.
Human-to-agent authority
The first delegation in the chain, who should make it, and why the owner field is not enough.
Agent-to-agent delegation
Keeping authority inside the original grant as agents hand work to other agents.
Accountability
Identity and inventory
AI agent identity
Who the agent is and how it authenticates. Necessary, and not the same as what it may decide.
Non-human identity governance
Finding, owning, and reviewing non-human identities. What it does well and where it stops.
Workload identity
A verifiable identity tied to where software runs. The right foundation for agents, and only the foundation.
Agent discovery
Finding the agents in your environment. Useful, and not a control.
Shadow AI agents
The agents nobody registered, and the control that does not depend on finding them first.
Humans define authority. BotAris enforces it.
BotAris is onboarding a limited group of enterprise design partners. Design partners shape the product roadmap and receive early access. If you are putting agents into workflows with real consequences, we want to talk.