From Conversation to Delegation

Priya has decided what she wants to do about the Berlin trip. The last chapter ended with her statement of who does what, and she has made up her mind about one part of it: she will hand over the hotel. She does not want to search, compare and click through confirmation pages herself. She is happy for the system to do it, within limits she is clear about.

Until now, every output of the system has been something she could look at before anything happened: a view, a summary, a draft, a reminder. A booking is different. It changes the world. A hotel is reserved, money is committed, a cancellation window starts to run. The move from conversation to action is the first point in the book where a mistake cannot be corrected by editing a screen. So a further question has to be answered with something stricter than a preference:

What is the system actually authorised to do?

The last chapter asked what Priya wants the system to do. This one asks what it is permitted to do. They are related and they are not the same question.

desired participation
        ↓
explicit grant
        ↓
action gate
        ↓
data-use gate
        ↓
execution
        ↓
receipt
        ↓
revocation

Three questions, now complete

The book has been circling a triangle, and this chapter completes it:

competence  ≠  authority  ≠  desire

The chapter on resemblance showed that accuracy does not create authority. The last chapter showed that even authority does not settle what she wants. This one deals with authority itself. Competence is whether the system can do the thing well. Desire is whether she wants it to. Authority is whether it has been given the standing, and it is the only one of the three that can be checked mechanically.

A grant

Authority is created by something she does, and the thing she does should be small and explicit. A grant needs only five parts:

Delegation grant

Principal:     Priya

Scope:         Book one refundable hotel for Berlin.

Constraints:   - up to €350 per night
               - within 2 km of the conference venue
               - refundable only

Duration:      Until the booking completes, or Friday 18:00.

Revocation:    Available at any time before purchase.

A grant describes authority. It does not describe what she is predicted to prefer, and it says nothing about what the system believes she would like. The two should never be mixed. The system may know she likes quiet rooms. The grant does not say to find one. It says what the system may do, and any preference the system applies inside the grant is a choice made within its limits, not an extension of them.

Natural language is a fine way to write a grant. Priya can say it in a sentence. But the sentence has to be turned into something that is checked, and the thing that interprets her words must not also be the final enforcer of them. If the same model that wants to book the hotel reads the grant and decides whether it applies, the check is only as good as the model’s own reading. The grant that is enforced should be a plain statement of limits that something other than the actor evaluates.

The action gate

Between an intention to act and the act sits a gate, and it should be blunt:

is the requested action inside the grant's scope?
do all the constraints hold?

Only when both answers are yes can the action go ahead. Where the action is permitted but consequential, the answer may be to ask her first. Approval follows the consequence and the reversibility of the action, and never the system’s confidence: ninety-nine percent confidence that she wants the purchase does not buy the purchase.

This makes the hard line of the chapter easy to state.

Competence cannot widen authority.

A highly capable model that fails the gate must still not act. It does not matter that it would have chosen a better hotel, or that the booking would have saved her time, or that she would have approved. The gate does not ask whether the action is wise. It asks whether it is authorised.

Two different failures should be kept apart here, because their remedies differ. A system that attempts a €380-a-night booking has violated the grant. It is stopped at the gate, and that is a failure of authority. A system that books a €330 room that is mediocre, within every limit, has done what it was permitted to do and done it badly. That is a failure of competence. Neither excuses the other: authorisation does not make a poor choice good, and a good choice does not make an unauthorised one acceptable.

There is a quieter point about what the gate checks. The record it evaluates, which says what the system is about to do, with what, for what purpose, has to be built from the actual operation by something other than the model proposing it. If the model writes the description of its own action, the gate is judging a self-description, and a self-description can leave things out. Where the proposal comes from is part of what makes the check trustworthy.

Data is a separate gate

An action is one thing and the information used to carry it out is another. The system may be authorised to book a hotel and not authorised to use everything it can see in order to do so.

authorised action:   book a hotel

available data:      calendar
                     location history
                     medical records
                     private messages
                     saved preferences

The question is not whether more data would improve the result. More data usually would. The question is whether this particular data is necessary for this action and permitted for it. The conference dates, her declared budget and the venue’s location are. Her medical records, and the contents of her private messages, are not, however useful some stray detail in them might turn out to be. Unnecessary use is a failure even when nothing leaks: a system that reads a mailbox to find a date it could have had from the calendar has overstepped, whatever it did with what it read.

The two gates should not be merged. Which information a plan requires and which action it will perform become visible at different moments in execution, and each should be checked where it can actually be seen. The data-use gate also has a wider cousin, since several pieces of information that are individually permitted can together reveal more than any one of them. That question comes later, where the system speaks and discovers on her behalf. Here the point is only necessity.

Narrowing, never widening

A grant rarely stays with one actor. The system may break a task into parts, hand parts to other tools or agents, and have those do further work. What each one is allowed has to follow a simple rule:

grant
   ↓
subtask
   ↓
same or narrower authority

“Book a refundable hotel” can become “search hotels” and then “compare five options”. Each step carries the same authority or less. What cannot happen is the reverse:

book a hotel
      ↓
also book flights, because it is convenient

That is an invention of authority. Nothing in the original grant covered flights, and the fact that booking them would help does not make it permitted.

Delegation may decompose authority. It may not invent more of it.

The same rule applies to limits that pass downstream: a subtask inherits the narrowest bound, never the widest one available. A child’s authority is always contained within its parent’s.

Receipts

When the system acts, it leaves a record that closes the loop. The record should be short and answer one question: under what authority was this done?

Delegation receipt

Grant:         Book one refundable hotel for Berlin.
Action:        Reserved Hotel X.
Constraints:   Satisfied.
Data used:     conference dates, declared budget, venue location
Authority remaining:  None.
Revocation:    No longer applicable after the completed purchase.

It is not a giant audit log, and it should not become one. It records what happened, which authority permitted it and which information was used, and no more. A receipt that grew into a dossier of everything the system touched would be a new store of her data, kept for the sake of accountability.

Revocation that wins

Authority that cannot be withdrawn is not delegation. Suppose Priya grants the booking at 09:00 and revokes it at 09:12. At 09:13 the system, which has been preparing the reservation, attempts to execute it.

grant issued        09:00
grant revoked       09:12
execution attempt   09:13
        ↓
DENY

There is no room here for “it was already preparing” or “it would probably still be useful”. The gate is checked at the moment of action, so that a revocation made in the middle of a long task takes effect for everything that has not yet happened. Revocation has to dominate.

It has limits worth stating honestly. Revoking authority stops what has not yet been done. It does not undo what has. If a purchase completed at 09:10, the revocation at 09:12 does not reverse it, and anything already disclosed stays disclosed. Stopping future action and reversing past action are different things, and a system should report which of them has actually happened.

Where this leaves us

Authority is created by an explicit grant of five parts, checked by a blunt action gate and a separate data-use gate, narrowed and never widened as it passes along, recorded in a short receipt and withdrawable at any moment. Competence cannot widen authority, and authorisation does not repair a poor choice. The system’s confidence plays no part in what it may do.

The last four chapters can now be held in one chain, none of whose links implies the next:

prediction  ≠  identity  ≠  desire  ≠  authority  ≠  action

Predicting a person is not being her, being her is not wanting what she wants, wanting something done is not being permitted to do it, and being permitted does not mean the act is carried out well or at all.

With a grant, Priya can authorise the system to act for her. But acting is not the only way a system can stand in for a person. It can also speak in her name. A message sent on her behalf is an action that makes claims, promises and commitments others will attribute to her, and it needs a kind of authority of its own.