Nobody Asked It To Is Not a Defense

"Nobody asked it to" is a true statement that functions as an admission. The fix is not a human approving every action. It is four fields, filled in once per class of action.

There is a specific silence that follows that sentence in a room where it does not work.

It plays fine in engineering. It is true, it is precise, and among people who understand the architecture it is a complete and satisfying explanation. Then the same sentence gets said in front of a board committee, or a regulator, or opposing counsel, and it lands as an admission — because to everyone in that second room, “nobody asked it to” is not a description of how the system works. It is a confirmation that nobody was in charge.

Three weeks of this have been about the gap. This one is about the artifact that closes it.

What It Isn’t

Start here, because the false choice is what stops most organizations from beginning. The authorization record is not a human approving every action. That approach destroys the entire economic case for agents and every team that tries it abandons it inside a quarter.

It is also not a policy document, not a slide, and not a statement of intent. Intent is what you have now.

What It Is

For any action your system takes, you can name the person who authorized it. That is the whole test.

Four fields make it possible:

• Name — the human who authorized this class of action.
• Date — when they did it.
• Boundary — what, exactly, they said yes to.
• Review trigger — the event that makes someone look at it again.

Why It Works at Volume

It operates at the level of the class, not the action.

You do not authorize a refund. You authorize refunds under a stated threshold, on a stated date, with a stated review. The agent then takes ten thousand actions inside that boundary, and every one of them traces to a person who agreed to the boundary and can explain why. The volume problem disappears, because the record was never about volume.

The Law Already Asks This

The EU AI Act never uses the word “agent.” It has nonetheless already made this a requirement rather than a practice. Article 14 obliges high-risk systems to be designed so that they can be effectively overseen by natural persons. Article 26 places the duty on the deployer — the organization actually running the system — and specifies that the people doing that overseeing must have “the necessary competence, training and authority.”

That last word is the one to sit with. Not visibility. Not access. Authority.

The regulation is not asking whether someone can see what the system did. It is asking whether a named person had the standing to permit it. Which is, word for word, the question this series has been circling for a month — and the question your board will eventually ask in plainer language.

Build It Against the Four Surfaces

Build it against the four surfaces from last week and it stays honest.

• The credential — who authorized this agent to reach these systems, and what was the task? You did this inventory in week two.
• The tool grant — who authorized this agent to invoke these functions? And specifically: was that person evaluating the authorization, or evaluating whether the code compiled? Those are different signatures and only one of them counts.
• The instruction — who owns this text as policy? Not who wrote it. Who owns it. If the honest answer is “whoever touched it last,” you have found the surface where the record is weakest, and it is usually the one with the widest behavioral reach.
• The memory — what has the system written down about how work gets done, who has read it, and when? This is the field most teams cannot populate on the first attempt, and it is the field the outside question is most likely to land on, because it is where an agent’s behavior diverges from anything a human ever specified.

Populate those four rows and something changes that is worth more than the compliance posture. You stop discovering your own system’s authority by reading incident reports. The record becomes the thing you consult before you extend the agent’s reach, rather than the thing you reconstruct after it went somewhere you did not expect.

The organizations that will be fine here are not the ones with the most controls. They are the ones that can answer in a sentence. Someone will ask — a board member, a regulator, a customer, a journalist — and the entire difference between a hard afternoon and a very bad quarter is whether the answer is a name and a date, or a shrug and four words.

If you want a structured starting point, the AI Readiness Audit walks the same ground as a pre-authorization inventory — what you have, what it can reach, and who agreed to it — before you extend anything further. It is free, it is open source, and it takes an afternoon.