Agent authority review

The decision on your calendar.

A vendor or employee assistant can do more than answer a question. The approving owner needs to know whose permission it uses and how that permission ends.

Bring the sources you are allowed to share.

• The intended principal and accountable roles
• A description of the allowed data and actions
• Existing permission and authentication rules
• Available expiry, revocation and stop-control evidence

The file your institution keeps.

• A declared agent authority card
• Employee, vendor and customer-assistant boundaries
• Expiry and revocation questions
• Shutdown ownership and test questions
• An approval queue for your own reviewers

Three places to examine.

• Employee assistants acting inside your institution
• AI features inside a vendor service
• Customer-delegated assistants seeking access

Discovery identifies a declared use. It does not grant authority or verify identity. Permission, its principal, and evidence of revocation stay separate.

This review draws on the governance questions in Know Your Agent. Agent Permission Review is an additional technical method.

Four working steps.

1. Agree the questionOne workflow, permitted inputs, accountable owner and the decision due.
2. Prepare the sourcesKeep versions, missing records and assumptions visible.
3. Review the evidenceRetain failed cases. Your team reviews the proposed answer and open questions.
4. Leave the fileA one-page recommendation, supporting records and named next actions.

Your team owns review and acceptance.

Your IT and risk owners verify authority and controls in their environment. A supplied identifier is a record reference; verification is a separate task.

Timing depends on agreed inputs and customer review. Corrections within the agreed scope are recorded in the file; a new use or workflow requires a new scope.

Inspect the method.

See the agent access method. Browser methods work on supplied inputs or inspectable examples.

Scope and fee.

Scope and fee fixed in writing after one working session. The written scope names the sources, customer review responsibilities, deliverables and corrections included.