You ask an AI agent to book a hotel for a weekend trip.
You provide the travel dates and set a budget of €200 per night. Within those limits, the agent can make the booking without asking for further approval.
The agent has access to a booking system. It can search for hotels, select rooms, and complete reservations.
It finds a room for €180 per night.
Now consider two possible bookings:
Booking A: The room is available for your chosen weekend.
Booking B: The same room is available at the same price, but only one week later.
The agent could technically complete either booking. The booking system could accept both, provided the room is available on the selected dates.
But you authorized the agent to book a hotel for a specific weekend.
The second booking falls outside that authorization.
The distinction matters because an AI agent’s ability to perform an action does not automatically mean it has permission to do so.
An agent may have the technical capability to make a booking (capability). It may have access to the booking system (access). But neither tells us whether it has the authority to make a particular booking (authority).
That depends on the task it was given and the conditions attached to it.
In this example, the agent can book a hotel independently, but only for the agreed dates and within the specified budget. It does not need separate approval for every booking that meets those conditions.
What happens if it tries to book the room for the following weekend anyway?
A control might prevent the booking by checking whether the selected dates match the original instructions. But the booking could also go through if no effective control checks those conditions. The booking system itself may not know which dates you originally specified.
An action can be technically possible without being authorized.
And even when an agent has been given a clear mandate, that does not automatically mean its boundaries will be enforced.
Understanding what an AI agent can do therefore requires more than knowing its capabilities or which systems it can access.
We also need to know what it is authorized to do, and whether those limits are enforced when it acts.
Further Reading
Stable Identity, Variable Authority
In the Google agent identity architecture examined here, an agent can have its own cryptographically verifiable identity and serve as a principal in IAM systems.