> ## Content Index > Fetch the complete content index at: https://blog.aperion.ai/llms.txt > Use this file to discover other available public pages before exploring further. # The missing verb - URL: https://blog.aperion.ai/the-missing-verb/ - Published: 2026-09-17T12:37:23.000Z - Updated: 2026-09-17T12:37:23.000Z - Description: Agents act on a person's authority at machine speed. When one goes past what the person authorized, where does the action go? - Author: Craig Alberino - Tags: Runtime Governance, accountable human, human in the loop, Trust Fabric, Agent security --- Every description of enterprise AI governance answers four questions. Who is the human. What is the human allowed to do. What did the agent send. Can we prove it. Those are the right questions. They leave one out. An agent is not a person. It acts on a person's behalf, at machine speed, on that person's delegated authority. Sooner or later it reaches past that authority. Sometimes because it was told to. Sometimes because the task drifted. Sometimes because a document it read on the way told it to. At that moment, what it sent matters less than who decides, and how anyone will later know that they did. Nothing in the enterprise stack is named for that question. Identity systems answer it once, at onboarding. Access systems answer it in advance, in a policy written before the situation existed. Observability answers it afterward, in a log. The moment itself, the agent at the edge of its authority with a live action in hand, belongs to nobody. ## What "we block it" leaves out The category's default answer is enforcement. The gateway sees the action, the policy fails, the action stops. Blocking matters, and every policy engine in the market does it. Two things are wrong with it as the whole answer. It puts the judgment in the vendor's layer. A CISO who buys an inline control is buying a machine that halts a wire on its own reading of a rule. Boards and regulators expect a named person to own that decision. And it forces a choice nobody wants. Fail closed, and the control breaks the business every time a rule meets a case it did not anticipate. Fail open, and the control is decoration. Every policy has to pre-encode every judgment call, or the enterprise picks which failure it prefers. ## Send it back There is a third option, and it is older than any of this software. When a person exceeds their authority, the request goes up to someone who has it. The same thing works for agents, if the layer in the path can do three things. **Know whose authority the agent is using.** The human, by name, rather than a service account. The agent's credential is bound to a named person at delegation, with the scopes and limits that person is permitted to hand down. **Hold the action without deciding it.** When the agent reaches past the delegation, the call pauses in the path, unexecuted, and goes back to the person whose authority it is spending. She sees what the agent is trying to do, in plain terms: this much, to whom, for what. She says yes or no. The assurance scales with the risk: a push to her phone for a routine action, a live face check for a wire. **Prove that she decided.** The record that survives shows a named, verified person authorized or denied the action, at a timestamp, on a specific policy version, unaltered since. That is the artifact an examiner wants. A log says something happened. This says who decided. ## What it changes Ambiguity stops being a policy problem. The cases a rule cannot anticipate route to a person instead of to a default. Fail-open versus fail-closed becomes a question about telemetry. Money does not move on a default. The vendor stops being the decider. The layer's job is to get the decision back to the accountable human and to keep the proof. Judgment stays where the board expects it. The evidence means something. Runtime governance without a human decision produces a very good log. With one, it produces the record supervisors ask for: who authorized this, and how do you know. ## Four layers, one verb Identity proves the human. Access scopes the authority. Runtime holds the agent to that authority and sends it back when it exceeds it. Audit proves the human decided. That chain is the product. Ask any vendor in this category one question: when the agent goes past what its human authorized, where does the action go? If the answer is a log, you have a record. If the answer is a person, you have a control.