Autonomous Principal
A software agent, workload or machine that can initiate actions without a human approving every step. It needs an identity and an accountable owner.
Autonomous authority glossary.
A working vocabulary for teams designing identity, delegation, policy and action-time control around autonomous systems.
55 Core Terms
Authority
Permission from a valid origin to cause a specified outcome within limits; broader than simple access to a resource.
Delegated Authority
A bounded grant passed from an authorized parent to a child principal for a defined task.
Authority Graph
The traceable set of origins, grants and parent-child relationships used to explain a requested action.
Policy Envelope
Constraints on a valid grant, such as action, target, value, purpose, time or operating state. Policy narrows authority; it does not create it.
Continuous Trust
Reassessment of relevant identity, risk, task and context signals while a principal continues acting.
Runtime Control
The decision made before a consequential operation crosses into execution.
ALLOW
A decision that the specific evaluated request may execute under its current grant and context.
DENY
A decision that the request must not execute because authority or policy does not permit it.
ESCALATE
A decision that requires an approved human or workflow review before execution.
DEGRADE
A decision that removes higher-risk capability while explicitly retaining a safer subset.
Machine Identity
The identity of a device, service or workload, including its owner, credential and lifecycle context.
Non-Human Identity
An identity used by software, services, devices or agents rather than an interactive person.
Agent Identity
The distinct identity and attribution of an autonomous software principal, separate from the workload credential it may use.
Action Authority
Permission to perform a particular consequential operation on a target under defined conditions.
Authority Origin
The accountable organization, person or approved process from which a valid grant ultimately derives.
Authority Chain
The ordered path from origin through parent and child grants to the acting principal.
Revocation
Withdrawal of a grant or parent authority so future dependent actions are no longer permitted.
Verification
Evidence connecting an actor, grant, policy, decision, execution response and observed outcome.
Consequential Action
An operation that can change external state, access, money, configuration, safety or another material outcome.
Execution Boundary
The tool, API, application or controller point where intent can become a real-world effect and authorization must be enforced.
Authority Grant
A scoped permission issued by an accountable origin or valid parent. It identifies the acting principal, permitted operation and target, constraints, expiry and revocation relationship.
Monotonic Narrowing
A delegation rule under which every child grant is no broader than its parent across action, target, time, value and further delegation. A child cannot add a permission by changing principals.
Runtime Authorization
A decision on a concrete action using the grant, policy and current context at the point where execution can still be stopped. A task-start check alone cannot cover later changes.
Policy Enforcement Point
The component that applies an authorization decision to the protected request. It must be on every relevant route to the external effect, including retries and direct API calls.
Policy Decision Point
The component that evaluates a trusted subject, action, resource and context under current policy and returns a decision with a reason and validity boundary.
Tool Authorization
Permission for a specific tool operation, target and argument set. Listing a tool or authenticating to its server does not authorize every invocation.
Execution Receipt
A record from the component attempting a protected effect, with decision reference, request digest, executor identity and downstream response. It is not necessarily proof of final state.
Decision Receipt
An immutable account of what request was evaluated, under which grant and policy, when, and why it was allowed, denied or escalated. It does not assert that execution occurred.
Observed Outcome
A later observation of the protected system’s state, correlated with the attempted operation. It may confirm success, failure, partial application or an unresolved condition.
Delegation Depth
The number of grant handoffs between an accountable origin and the acting principal. A depth limit bounds how far permission can be subdelegated.
Shared Authority Budget
An aggregate ceiling consumed by multiple children of one authority origin. Concurrent reservations and uncertain outcomes must count against the same ceiling.
Purpose-Bound Authority
Permission tied to an approved task or business reason. A caller-supplied purpose string alone is insufficient unless issuance and enforcement connect it to an accountable source.
Task-Bound Authority
A grant restricted to a named task, allowed operations, target set and lifetime. Completion or cancellation should end dependent authority.
MCP Server
A Model Context Protocol peer exposing resources, prompts or tools to a client. Server access and each tool’s business permission are separate decisions.
MCP Client
The protocol peer that connects to an MCP server on an application’s behalf. Its transport credential should be scoped to the intended protected resource.
MCP Gateway
An intermediary that may route or check MCP traffic. It cannot by itself protect a downstream API that remains reachable by an unchecked path.
Fail Closed
A failure rule that denies a protected effect when required authority facts cannot be verified. A separately defined reduced mode may retain lower-risk operations.
Degraded Authority
An explicitly narrower capability set used when policy, identity or context services are impaired. It must not silently retain write privileges from a stale allow.
Time of Check to Time of Use
The interval between a permission check and the external effect. Changed targets, grants or state in that interval can invalidate the original decision.
Approval Binding
A link between a reviewer’s approval and the exact actor, task, operation, target, key arguments, expiry and use count presented for review.
Confused Deputy
A privileged agent or service induced by a lower-trust requester to perform an effect the requester could not authorize directly.
Agent Handoff
A transfer of work and any narrower grant from one autonomous principal to another. Shared credentials are not evidence of a valid handoff.
Agent Fan-Out
One parent dispatching work to several children. The architecture must preserve shared limits and revocation across all concurrent branches.
Agent Convergence
Several agents combining outputs or approvals before one effect. Each contributing authority and any required intersection must remain identifiable.
Idempotency
A property that makes a retry of the same business operation return the recorded result rather than cause a second effect. The key must be bound to the request parameters.
Replay Resistance
Protection against reusing an old authorization or approval for a new action, altered parameters or a later time outside its valid scope.
Policy Version
The identified ruleset evaluated for one decision. A receipt should retain that version so later policy edits do not rewrite the historical reason.
Shadow Agent
An autonomous principal operating outside an organization’s known inventory or ownership process. Discovery alone does not establish its permitted authority.
Orphaned Agent
An agent identity or grant with no accountable current owner or active task. It should be investigated before being trusted for a consequential action.
Agent Registry
An inventory of agent identities, owners, environments and lifecycles. A registry is a discovery and governance input, not a grant of action permission.
Resource Indicator
An OAuth parameter identifying the intended protected resource during authorization. Audience binding helps prevent a token for one service being reused at another.
Token Audience
The service or protected resource for which a token was issued. An MCP server must reject a token whose audience belongs to a different resource.
Credential Delegation
Passing or exchanging credentials across principals. It needs explicit scope and audience control; forwarding a bearer token through a tool can expose unrelated rights.
Runtime Risk Signal
A time-sensitive fact such as incident assignment, resource posture or approval state used to narrow an otherwise valid grant at the action boundary.
Identity establishes the actor. Authority describes what that actor may cause. Policy narrows a valid grant. Runtime control decides at the execution boundary. Verification records why the action occurred and what followed.
Read the autonomous-authority guide →Architecture Conversation