Reading · Command Line with Camille

This page did not load. You can still read it on the original site — the toolbar below keeps your place in the directory.

As AI systems gain autonomy, unclear authority, invisible delegation, and decision-right drift are becoming major sources of organizational risk.

Most people have experienced a moment when nobody seemed to know who was in charge.

Sometimes it happens during a crisis. Sometimes it happens during a project that spans multiple teams. Sometimes a problem emerges, everyone assumes someone else owns it, and valuable time disappears while people determine who has the authority to make a decision. Frustration grows, coordination slows, and risks that could have been contained become harder to manage because authority is less clear than the situation demands.

Organizations spend enormous amounts of time managing technology risk, financial risk, regulatory risk, and operational risk. Yet many of their most persistent vulnerabilities emerge when authority itself becomes difficult to see.

Building the system, funding the initiative, and writing the policy are all forms of ownership, but they do not answer the question that becomes decisive during moments of uncertainty. Organizations remain exposed when they cannot identify who has the authority to authorize action, establish constraints, intervene while systems are operating, and remain accountable for outcomes. As AI, automation, and increasingly distributed operating models become embedded throughout organizations, authority is becoming easier to delegate and harder to observe. That shift creates a growing attack surface.

Traditional attack surfaces describe where systems can be accessed.

Authority surfaces describe where organizations can be influenced, manipulated, or committed through decisions that have been delegated but not fully governed.

While most security discussions focus on vulnerabilities in code, infrastructure, or identity systems, authority vulnerabilities often emerge through organizational design choices that remain invisible until something goes wrong.

Organizations Already Understand the Value of Governing Authority

The challenge itself is not new.

Organizations have spent decades building mechanisms to ensure authority remains visible, bounded, and accountable. Financial controls provide one familiar example. Approval thresholds, delegated spending authority, procurement controls, segregation of duties, and audit requirements all exist because organizations understand that once people gain the ability to commit company resources, authority must be accompanied by oversight.

Communications functions evolved around the same logic. Most organizations maintain clear approval paths for public statements, regulatory communications, commercial commitments, and external representation because communication creates obligations. A statement can alter customer expectations, create legal exposure, influence revenue, and reshape trust. Leaders generally accept these controls because they support performance rather than restrict it. Teams move more confidently when decision rights are clear, and organizations scale more effectively when escalation paths are understood before problems arise.

Despite these longstanding lessons, many organizations are introducing AI systems that shape customer interactions, trigger workflows, generate recommendations, and influence operational outcomes without applying equivalent clarity to delegated authority. Infrastructure weaknesses remain important, but exposure can also emerge when authority expands faster than organizations realize.

Authority Often Drifts Before Anyone Notices

One reason organizations struggle with this challenge is that authority rarely expands through a single deliberate decision.

A workflow is automated to save time. A model receives additional permissions because a pilot project was successful. Teams become comfortable accepting recommendations that were originally intended to be reviewed. Systems that once generated drafts begin publishing responses automatically. Each decision appears reasonable in isolation, and each change often delivers measurable business value.

Over time, however, organizations can find themselves delegating decisions they never consciously intended to delegate.

Authority drift often escapes attention because organizations tend to evaluate systems based on capabilities rather than permissions. Leaders ask what a system can do, whether it improves efficiency, and whether it delivers value. They spend less time examining how decision rights, intervention mechanisms, and accountability structures evolve alongside those capabilities. As a result, authority can expand gradually without triggering the same scrutiny that accompanies budget increases, organizational restructures, or major technology deployments.

This drift becomes more difficult to detect because responsibility and authority no longer move together. Product teams may define success while engineering controls implementation. Security establishes guardrails while business leaders determine acceptable risk. Legal interprets obligations while operations manages execution. Work continues, but the relationship between responsibility and intervention becomes increasingly fragmented.

Responsibility determines who is expected to respond when something goes wrong. Authority determines who can change direction before consequences accumulate. When systems operate faster than organizations coordinate, ownership gaps create constraint gaps, constraint gaps create inconsistent decisions, and those decisions eventually surface as operational, financial, legal, or reputational consequences. By the time those consequences become visible, reconstructing who could have acted often becomes difficult.

This dynamic appears differently across organizational structures. Startups frequently rely on proximity and speed instead of formal governance mechanisms because leaders can make decisions quickly and correct mistakes in real time. Large enterprises face a different challenge as authority becomes distributed across functions, committees, vendors, and platforms. AI compresses the margin for both approaches by allowing startup informality to scale further than intended while reducing the amount of time enterprises have to coordinate before consequences accumulate.

Ambiguity is one of the most reliable sources of exposure.

The Air Canada Chatbot Case Was Ultimately About Authority

One of the clearest recent examples came from Air Canada.

In 2024, a customer asked Air Canada’s website chatbot about eligibility for bereavement fare reimbursement. The chatbot responded that the customer could purchase travel and request reimbursement afterward. The customer relied on that guidance, completed the purchase, and was later denied reimbursement. During proceedings, Air Canada argued that the chatbot generated its own responses and therefore should not create liability for the company. The tribunal rejected that argument and held the airline accountable for information delivered through its systems. An American Bar Association analysis of the ruling highlights how responsibility remained with the organization regardless of the technology used to communicate with customers.

Much of the discussion that followed focused on hallucination risk and model accuracy. Those concerns matter, but they do not fully explain why the incident became a business problem. The more consequential issue involved the delegation of authority.

The case raised questions about who defined acceptable customer representations, who retained intervention rights, and how authority had been translated into automated interactions. Without clear answers to those questions, the organization effectively allowed commitments to emerge from a system whose authority was neither fully visible nor consistently governed.

Customers do not experience governance structures, approval workflows, or organizational charts. They experience a single organization. Commitments communicated through an employee, a website, a chatbot, or a workflow are generally interpreted as commitments made by the company itself. That expectation explains why organizations routinely investigate governance failures when employees exceed their authority. Automated systems increasingly belong in the same category.

Authority Ambiguity Has Been Creating Risk for Years

The underlying dynamic extends well beyond generative AI.

Investigations into the Boeing 737 MAX crashes highlighted how assumptions about intervention authority can become embedded in automated systems, creating consequences when humans and organizations can no longer respond as expected. A U.S. Senate Commerce Committee investigation examined not only technical design decisions but also broader questions of oversight, escalation, and accountability across the organizations responsible for development, certification, and operation.

That pattern appears repeatedly across industries. As I have explored elsewhere in this series, Knight Capital remains a useful illustration of automated execution outpacing intervention capability. According to the SEC enforcement order on Knight Capital Americas LLC, software deployment failures cascaded into approximately $440 million in losses because the organization lacked mechanisms to interrupt execution quickly enough once conditions changed.

More recently, parcel delivery company DPD temporarily disabled part of its customer chatbot after users manipulated it into generating inappropriate public responses. As reported by the BBC coverage of the DPD chatbot incident, users did not compromise infrastructure or obtain privileged access. Instead, they discovered that the system could speak with institutional legitimacy in ways the organization had not fully anticipated.

Across these examples, the common thread is not technology. It is the relationship between delegated authority and intervention capability. Organizations encounter difficulty when systems gain the ability to act faster than governance mechanisms can observe, constrain, or redirect them.

Governance Must Become Operational

Many governance conversations stop at structure.

Organizations create committees, publish principles, establish review boards, and expand approval processes. Those efforts create alignment and clarify expectations, but they rarely operate at the speed of execution.

As systems move from experimentation into operations, authority increasingly needs to become executable.

Fortunately, most organizations already possess the foundation required to begin. Delegated authority structures exist today across finance, procurement, communications, incident response, vendor governance, and escalation management. The challenge is extending those decision-right structures into environments where systems act.

A useful first step is identifying the five most consequential decisions AI-enabled systems can make today and documenting who has the authority to approve those actions, constrain them, and intervene when conditions change. That exercise alone often reveals assumptions that have never been explicitly examined.

From there, organizations can map authority across three dimensions: authority to act, authority to constrain, and authority to intervene. The first determines what decisions or actions systems may perform independently. The second defines who establishes and modifies operating boundaries. The third identifies who can pause, override, or reverse outcomes when conditions change. Once those authorities become visible, organizations can translate them into workflows, technical controls, monitoring requirements, escalation paths, and evidence mechanisms.

Visibility alone, however, is not enough because authority rarely remains static. Permissions expand, workflows evolve, models gain new capabilities, and systems become integrated into new business processes over time. Organizations therefore need mechanisms to periodically reassess delegated authority and monitor for changes that alter what systems can do, who can constrain them, and who can intervene when conditions change.

Authority mapping should be treated less like an annual governance exercise and more like identity management, vendor management, or vulnerability management: a continuous process because authority, like access, changes over time. As systems become more autonomous, organizations increasingly need ways to understand not only what authority has been delegated, but how that authority is constrained, how actions are attributed, and how intervention occurs once execution begins.

The objective is not perfect control. Organizations have never operated with perfect control. The objective is ensuring authority remains visible after delegation so that accountability, intervention, and governance remain possible as systems become more autonomous.

Authority Clarity Creates Business Value

Governance discussions often frame speed and control as competing priorities. Experience suggests a different relationship.

Financial controls emerged because organizations needed a way to scale decision-making without sacrificing accountability. Communications governance evolved because organizations needed to protect trust while engaging increasingly large and diverse audiences. In both cases, clearer authority enabled better performance.

AI appears to be accelerating the need for a similar transition.

Organizations already delegate authority every day to employees, vendors, platforms, and increasingly autonomous systems. Their long-term advantage may depend less on how much authority they delegate and more on whether they understand where that authority resides, how it expands over time, and who retains the ability to intervene when outcomes diverge from intent.

The organizations that navigate this transition successfully will not necessarily be those with the most advanced models. They will be the ones that can consistently answer three questions: What authority has been delegated? What constrains its use? And who can intervene when circumstances change?

Those questions sit at the heart of governance in an increasingly autonomous world.

Risk rarely concentrates where systems are most advanced. It concentrates where authority becomes difficult to see.

If an AI-enabled system in your organization created a customer obligation, financial commitment, or operational disruption tomorrow, would your teams know exactly who retained the authority to approve it, constrain it, override it, and own the outcome?

Why Risk Concentrates Where Authority Is Unclear