What is delegated authority?

Delegated authority is the mandate an organization grants to an agent to make certain decisions on its behalf. It names the class of decisions, the limits that bound them, the conditions under which they may be made, and the person who is accountable for every decision made under it.

The word delegated matters. Authority does not originate with the agent. It is granted by a human who holds it, and it can only be as broad as what that human was entitled to grant. An agent has no authority of its own, only what has been delegated to it and not yet withdrawn.

Delegation is older than software

Every organization already runs on delegated authority. The board delegates to the chief executive. The chief executive delegates spending authority to functional leaders. A finance leader delegates to a manager the right to approve invoices up to a limit. Each delegation has the same structure: a scope, a ceiling, exceptions, and a name.

For most of the history of computing, this structure lived outside the systems. Nobody wrote down that the accounts payable clerk could approve invoices under a certain amount, because the clerk knew, the manager knew, and if the clerk got it wrong there was a person to have the conversation with. Access systems only had to answer whether the login mapped to an employee with the right entitlement. Authority was implicit.

Agents force it to become explicit. There is no person behind the credential who knows the limit. If the delegation is not written down and enforced, the agent operates with the full reach of its permissions and no ceiling at all.

What a delegation has to contain

Our position is that a delegation fit for an agent has five parts.

Decision rights: the class of decisions covered. Approve refunds. Resize compute. Route escalations. Not the API endpoints involved, but the business decisions.

Constraints: per-action thresholds and cumulative ceilings. Up to this amount per case. Up to this total per day.

Conditions: the circumstances under which the rights do not apply. Not on flagged accounts. Not during an active incident.

Escalation: where the decision goes when it reaches the boundary, and which accountable human it belongs to.

Provenance: who granted this delegation, on what basis, and when. This is what makes the record reviewable.

Delegating to a policy, not to an agent

A common approach is to attach delegated authority to each agent: find the agent, assign it an owner, grant it a mandate. This does not scale and does not reach the agents nobody found.

The alternative is to delegate to a policy. The support director owns the refund policy. Every agent that tries to issue a refund is evaluated against it, whether ten agents or ten thousand, whether registered last quarter or created four seconds ago. The number of policies is bounded by the kinds of decisions the business makes, which a leader can hold in their head. The number of agents is bounded by nothing.

This also fixes accountability. The director is accountable for the policy and for every decision made under it, including by agents they never saw. That is a fair thing to hold someone to, because they wrote the rule. Holding someone accountable for the specific actions of an agent they never reviewed is not.

Delegation across agents

When an agent delegates part of its work to another agent, the second agent's authority derives from the first, and the first agent's authority derives from a human. Each hop is an opportunity for authority to widen or drift. A sound delegation model requires that each hop may narrow authority and may never widen it, and that the check at the point of action evaluates against the governing policy, not merely against whatever the parent agent happened to hold.

Where BotAris fits

BotAris models delegated authority in the Authority Model: decision rights, constraints, conditions, escalation, and provenance, as governed policy owned by humans. The enforcement point evaluates every action against that delegation, including the chain of agents behind it, and the ledger records who authorized the decision and on what basis.