Wulf A. Kaal

· Artificial Intelligence, Governance

Permission Needs an Enforcement Boundary

A response to Alexandra E. Michael and Franziska Roesner, "How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement" (arXiv:2607.13718)

Abstract

Michael and Roesner show that agent permission systems divide into three layers: the interface presented to the user, the method that derives a permission specification, and the mechanism that enforces it. Their survey of 21 proposals and five commercial agents finds that none of the proposals combines low user burden, formally grounded specifications, and deterministic enforcement. This is not merely an interface problem. It is an institutional boundary problem. A useful permission system must settle identity, authority, permitted data use, responsibility, and remedy for each integration. It must also detect authority drift across a run, because separately acceptable actions can accumulate into an unauthorized result. Reputation and prior performance may help route work. They cannot enlarge permission. The result is a sharper design rule: agents may propose actions, but a separate system holding the relevant capability must decide and produce a durable receipt.

The survey finds a missing combination

Michael and Roesner do valuable conceptual work. They separate permission interfaces from the internal representations that describe allowed behavior and from enforcement mechanisms that determine what an agent can actually do. This distinction prevents a familiar mistake. A well-designed consent screen is not itself an access-control system.

The empirical result is sobering. Across the 21 proposals they study, none provides all three of the properties that a scalable system needs: near-zero burden on the user, a formally grounded permission specification, and deterministic enforcement. Commercial systems often choose between frequent user confirmation and an opaque model that decides whether the requested action appears safe. The first choice does not scale. The second delegates the meaning of permission to another probabilistic system.

The paper also identifies governance deficits beyond initial consent. Only six proposals let users change or revoke permissions after they are specified. No proposal formally verifies its enforcement mechanism. Most threat models assume a benign but fallible agent affected by hallucination or prompt injection. Far fewer examine an adversarial agent or provider.

Permission is an institutional settlement

The survey asks how permissions should be expressed and enforced. The relevant Kaal scholarship supplies a test for what the permission must settle. Each integration has to resolve identity, authority, permitted data use, responsibility, and remedy (Kaal 2026, claim 7314479-009). A permission design that answers only whether an operation is allowed leaves the remaining institutional questions open.

This matters because an agent run is not a collection of independent prompts. It is a sequence with cumulative effects. Authority drift occurs when each individual check passes while the aggregate conduct falls outside the authorization (Kaal 2026, claim 7314479-015). A prompt-by-prompt permission system can therefore approve every step and still fail at the level that matters.

The response is not a longer instruction. Informal governance cannot bind action at machine speed and scale, while a regime built entirely on formal verification may be institutionally inoperable (Kaal 2026, claim 6886078-001). The design has to combine a hard technical boundary with a workable allocation of judgment.

The agent proposes, the boundary decides

A permission system should keep the decisive capability outside the agent. The agent can propose a tool call, transaction, disclosure, or file operation. A separate component that controls the credential evaluates that proposal against a scope fixed by the principal. The agent cannot convert persuasive language, a favorable self-assessment, or prior success into new authority.

This separation also clarifies the role of reputation. Reputation may inform discovery, routing, pricing, and allocation. It may never grant permission or enlarge authority (Kaal 2026, claim 7314479-020). A highly rated agent may be chosen for more important work. It does not receive broader keys merely because it has performed well before.

Every consequential decision should then produce a durable artifact at execution time. That artifact should let a third party determine which policy applied, which boundary was enforced, and who is accountable without exposing the underlying content (Kaal 2026, claim 7314479-048). Revocation and later review become operational facts rather than entries in a settings panel.

What this adds to the paper

Michael and Roesner correctly make enforcement a first-class part of permission design. The institutional addition is that enforcement must be evaluated over the whole authorized relationship. The system needs to preserve the principal's authority, observe cumulative effects, identify responsibility, and provide recourse when the boundary fails. These requirements correspond to four recurring failures in agent governance: attribution failure, authority drift, evaluative capture, and recourse vacuum (Kaal 2026, claim 7314479-013).

The paper does not claim to demonstrate a complete permission architecture, and its survey cannot establish how any proposal performs under sustained adversarial use. Its strongest contribution is diagnostic. It shows that current designs distribute the essential properties across different systems. The Kaal framework turns that diagnosis into an institutional requirement: permission is valid only when authority remains bounded throughout execution and the system can prove what boundary governed the act.

References

Kaal, Wulf A. 2026. "Governance as a Product (GaaP): A Reputation-Weighted Institutional Architecture for Autonomous AI Agent Governance." SSRN. https://ssrn.com/abstract=6886078. Claim cited: 6886078-001.

Kaal, Wulf A. 2026. "Institutional Requirements for Sovereign Local Agent Runtimes." SSRN. https://ssrn.com/abstract=7314479. Claims cited: 7314479-009, 7314479-013, 7314479-015, 7314479-020, and 7314479-048.

Michael, Alexandra E., and Franziska Roesner. 2026. "How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement." arXiv:2607.13718v2. https://arxiv.org/abs/2607.13718.