Council Post: Why AI Agents Need A Chain Of Authority, Not Just A Human In The Loop

Stéphane Gervais, fundador y CEO de ApexTransform, describes a scenario where an AI procurement agent detects a supply shortfall at 2:00 a.m., chooses an alternate vendor, accepts revised terms, and commits six figures of spend—after passing authentication and permissions checks. He argues the post-incident review should focus on who authorized the commitment, because many organizations lack a verifiable chain linking AI actions back to legitimate human authority. Gervais distinguishes access from authority: authentication and technical authorization don’t prove an agent should take a specific action in context. He cites NIST’s work on software and AI agent identity and authorization, and OWASP’s risks around non-human identities.