The Authority Question Identity Can't Answer

Today in Pyrmont, Sydney, HashiCorp and IBM ran an invite-only security round-table for their partners and integrators, security professionals for the most part. The room, perhaps fifty strong, was polled live on how well their organisations govern the autonomous AI systems they now run in production. Two to three dozen answered each question. It is one event and a small room, so I will not pretend it is a survey of the industry. But it was not a random room either. These were security professionals, people who do this for a living.

And one thing came through clearly, whatever the exact split: among the five questions put to the room, one stood apart. It was not an identity question at all, and it was among those the room could least confidently answer. That question was who authorised the action an autonomous system had just taken.

That question is not a harder version of the other four. It is a different question, and the distance between the two is the whole subject of this post.

Almost Everyone Had Already Shipped the Action

The room had already deployed. Asked where their organisation was using autonomous systems, the overwhelming majority pointed somewhere on the live spectrum, from pilots to limited production to broad scaling, and almost no one said “not yet.” The action is not a roadmap item. It is live, calling APIs and moving records today, and almost nobody was waiting for permission to start.

Then came the question of whether they could even see what was acting. Asked if they had a complete inventory of their non-human identities (the agents, services and workloads operating on their behalf), almost no one could say yes, fully. The rest were partial, negative, or unsure. So the action had been industrialised faster than the ability to enumerate the things taking it. When you cannot list the actors, the first question an incident reviewer asks (which of these did this?) already has no clean answer, and the system has been in production for months.

Four of the Five Questions Have a Known Shape

The event’s premise, set out in the opening keynote, was that identity and access management does not scale to autonomous systems and that closing those access gaps is the work. That is the right problem, and a serious one. The people in the room are among the best equipped anywhere to solve it. Most of the discomfort the polls surfaced is genuinely an identity and secrets problem, and it is one the field already has strong tooling and categories for.

The credential question made that plain: the most common answer was not a method at all but “unsure”: more people said they did not know how their autonomous systems’ credentials were managed than named any single way of managing them. This is a real problem with a real shape. Inventory the non-human identities, get the secrets off disk, rotate them, scope them down.

Identity at scale is hard, the established answers help, and a room moving from “unsure” toward a managed platform is a room making genuine progress on a genuine problem. Inventory, credentials and containment are all versions of one question (who is in the system and what can they reach), and the security field has spent thirty years building the muscle to answer it. The fifth question is not in that territory at all.

The Fifth Question Is Not an Identity Question

Asked whether their current identity model could clearly answer “who authorised this action?” for an autonomous system, only a small minority said yes, always. Most could not say they reliably answered it, and unlike the inventory and credential questions beside it, this is not one that better identity tooling can close.

That is the tell, and it is the reason the room mattered. This was a room of security professionals, convened by two of the largest names in the field specifically to work the identity and access angle on autonomous systems. When even that room cannot answer “who authorised this action?” with identity and access tooling, the explanation is not that they need a better directory or tighter secrets rotation. It is that the question is not an identity question.

Identity tells you who is acting. It authenticates the actor, checks its role, confirms its credentials are valid and unrevoked. None of that answers whether the specific action in front of you was authorised — under whose delegation, within what scope, until when.

An autonomous system can hold a perfectly valid, perfectly scoped identity and still take an action no one ever granted it the authority to take, because the credential proved who was acting and was silent on whether the act was permitted. Knowing the actor is not knowing the authorisation. That is not a gap in the identity model; it is outside what an identity model is built to say.

This is why “who authorised that?” keeps coming back as the question nobody’s stack can answer. It is asking for a different artefact: an explicit record that this principal authorised this kind of action, under these conditions, and that the record was still valid at the instant the action ran. That artefact is authority, and it sits in a layer most architectures simply do not have.

Why Better Identity Cannot Close It

Scaling identity makes you better at the first four questions and no better at the fifth, because more identities managed more cleanly still produces no record of delegated authority at the moment of action. The two are different jobs. Identity governs who exists and what they can reach. Authority governs whether a given action, by a known actor, was permitted to happen at all. You can do the first job flawlessly and have no answer to the second.

The last poll showed where that ends. Asked whether they could contain a compromised autonomous system, only a small minority were confident; most sat somewhere between low confidence and not sure. Containment depends on revocation, and revocation depends on having granted the authority in the first place: you cannot withdraw an authority you never explicitly delegated. The authority question and the containment question, two the room answered with real unease, are the same gap measured twice.

This is the question that outlives the room. When the auditor arrives, the first request is for the authorisation behind a specific action, not the identity directory. When the incident report is written, the line that has to be filled in is not which credential but under whose authority. A stack that can produce the actor but not the authorisation has answered a real question and still left the one the auditor came for unanswered.

Identity Was the Right Problem, and Not the Whole One

The room surfaced the gap precisely — which is to its credit, and to the credit of an event that put the right people in one place to find it. It reached for identity, because identity is the heading the security field has spent thirty years building, and the natural place to file a problem about systems acting on their own. The agenda had even named accountability, set beside identity and control — and accountability for an action is the authority question wearing a softer word, the part of the problem the rest of the stack does not yet reach.

But “who authorised this action?” is not answered by knowing who is acting, however well you know it. It is answered by an explicit, scoped, still-valid record of authority at the moment the action runs, or it is not answered at all. Until that layer exists, the most any of these systems can tell you about an autonomous action is who took it. Who authorised it stays exactly where the poll left it: unanswered, in production, and first in line when something goes wrong.