Everything useful an AI agent does, it does on somebody’s authority. An agent that books travel spends your money. An agent that writes code commits to your repository. An agent that answers email speaks in your name. Strip away the model weights and the benchmark charts and what remains is delegation, the oldest arrangement in economic life, now running at machine speed.
The AI safety conversation mostly looks elsewhere. Capability gets measured. Alignment gets debated. Both matter, and neither describes the risk surface of the agents being deployed right now. That surface is authority. Who granted what, to whom, and what happens once it starts to move.
The numbers changed before the infrastructure did
A person delegates a few dozen times on a busy day. Sign this, review that, go talk to the vendor. Each handoff carries judgment. You know the person, you know roughly what they’ll do with what you gave them, and if it goes sideways you know where they sit.
Agent deployments break every part of that. The count of delegation events goes up by orders of magnitude. They happen without a person in the loop. They happen between parties who have never met and never will. An agent hires a sub-agent, which calls a service run by a company nobody in the chain has heard of, which spins up its own agent to fulfill the request. Four delegations deep, and the original granter has no idea the chain exists.
Human economies solved a version of this before. Letters of credit let a merchant in Genoa trust a buyer in Antwerp. Escrow let strangers close deals. Containerized shipping let goods cross a dozen jurisdictions without anyone unpacking the box. Each one lowered the price of cooperating with people you had no reason to trust, and each one took decades to build.
Agent delegation has no equivalent. What it has instead is the grant systems we already had lying around, and those come in one size. A coding agent needs to read design documents, so it gets the whole workspace. An analytics agent needs to look at transaction history and arrives holding the power to issue transactions, because there was only ever one credential to hand it. The analysis needs to read. It has no business writing. Nothing in the stack lets anyone say so.
Why this is a safety problem, not a plumbing problem
When authority can’t be narrowed, every delegation is an overgrant. Multiply that by the volume agents produce and you get a system where enormous amounts of unused permission sit in circulation, waiting for a prompt injection, a compromised dependency, or plain agent confusion to put it to work. Failures at this scale don’t happen once. They cascade, through chains of delegation nobody mapped, held by software that keeps running after the person who authorized it has moved on.
This is the gap the guardrail industry fills. Monitoring, logging, anomaly detection, review queues. All of it amounts to watching what an agent does because nobody could limit what it holds. Surveillance is what you settle for after the structural question has already been lost. And surveillance does not scale to a world where the watchers are also agents.
The structural question gets decided earlier, at the moment of the grant. Can authority be narrowed by whoever holds it? Can it cross into an organization that shares no administrator with the granter? Can it be revoked in a way that matches how organizations actually work? There is a body of research, capability security, that has been asking exactly these questions for decades and running pieces of the answer in production. It deserves far more attention from the safety community than it gets. Endo is the clearest example: a distributed JavaScript runtime built and believed in by the Agoric and Endo teams, where an agent starts with zero authority and holds only what it was handed. The work predates the current AI moment by years. AI caught up to it, not the other way around.
The agent economy is arriving either way. The delegation infrastructure underneath it is still the part nobody planned. That is a choice, and it is still open.
Meta description: AI agents run on delegated authority, and delegation is about to scale by orders of magnitude with no infrastructure built for it. Why authority, not capability, is the near-term AI safety problem.
Suggested slug: /delegation-economy-ai-agents
Primary keyword: AI agent delegation. Secondary: agent authority, AI safety, delegated authority.
