Authority Pattern Library · Architecture
AA-04 · Foundational Authority Constraint
Several sources of authority may apply to one action
An agent may operate within organisational delegations, contractual arrangements, externally imposed obligations and other recognised authority relationships. Their applicability depends on the subject, proposed action, purpose and circumstances.
This pattern examines the risk of treating those relationships as one undifferentiated permission. It does not make a legal determination or claim that agent authority replaces other model, security or operational risks.
Identify the relevant relationship
Technical access, an assigned agent role and permission for a consequential business operation answer different questions. Establish who or what acts, on whose behalf, through which delegation and within what limits.
An agent may prepare material, obtain information or propose work without having permission to commit the resulting operation. The distinction should survive handoffs between agents, people and applications.
Preserve external authority
Where an external, statutory, custodial or other recognised authority source constrains participation, the organisation must establish the applicable basis through the relevant governance process. A generated interpretation or local policy mapping does not alter that source's standing.
Where requirements are uncertain or conflict, establish the responsible resolution path. Hold, escalation, bounded preparation or refusal may be appropriate under the applicable rules; no one outcome is universally correct.
Human participation and evidence
When a person must exercise judgement, preserve their role, information and opportunity to influence the proposal. Record the source, scope and currentness of the authority relied upon, the operation performed and the observed result.
Native identity, policy and workflow controls may satisfy relevant responsibilities, with limitations assessed rather than presumed.
Explore in context
- Defence-Adjacent Sovereign Capability — Operating Context — independently governed capability participants.
- Dual Sovereignty Boundary — Operating Context — authority across institutional boundaries.
- Decision–Execution Decoupling — separate decision and execution settings.
Architecture and scope
Architecture of Record (AoR) records accepted standing, applicability and obligations. Execution Admissibility Architecture explains execution admissibility. Their publication does not demonstrate an implemented control or a requirement for a particular runtime.
This is an explanatory pattern, not an organisational assessment, issued Profile, legal opinion, compliance determination or implementation assurance.
© Arqua Pty Ltd. All rights reserved.