Imperium — AI Governance & Control
Who Authorized the Agent Behind the Agent?
When an assistant delegates to a sub-agent that calls another agent, the chain of authority can disappear. Delegation needs identity.
A person asks an AI assistant to prepare a report. The assistant delegates part of the job to a research agent, which calls another tool-enabled agent to retrieve data.
Who authorized the third actor?
The person may never have seen it. The original assistant may have had broad access. The child agent may inherit permissions without anyone checking whether they match the narrower task.
Delegation is where accountability gets blurry
Humans delegate work all the time, but organizations retain chains of responsibility. We know who requested a task, who approved access and who performed the action.
Agent systems can lose that chain. Logs may record the parent process rather than the real executor. A service credential may be reused for operations no individual explicitly approved. A harmless reporting mission can become an unexpected write action.
The problem is not that sub-agents exist. It is that delegation without identity turns a work graph into an accountability gap.
Live Stories Episode 01, The Employee Who Hired 15 Strangers, plays this out in a fictional company. One AI employee is hired on Monday. By Thursday, workers started by other workers are copying old archives onto a build server and sending what looks like a deploy key to an outside service. Ask each of them who authorized it: for some the chain reaches back to a person, with a stated confidence; for a retry started inside a third-party sandbox, the record simply stops.
The architecture executives should demand
Every consequential action should be linked to a human initiator, a mission, a uniquely identified executing actor and a constrained authorization. Child-agent credentials should be scoped to the delegated task, expire quickly and never silently expand the parent's permissions.
Administrators should be able to answer: who requested this, who executed it, why was it permitted, and what evidence proves that the policy was enforced?
An audit event saying “allowed” or “denied” is useful, but enforcement must happen at a boundary that actually controls the action. Observing intent after the fact is not the same as preventing damage. AFPM Lab 03, Denied. Still Returned., shows the gap in a simulation: a child agent asks a CRM for two restricted fields, the policy decision is DENY, no enforcement follows, and the response carries both fields.
When the audit committee asks
Suppose a sensitive file was accessed during an automated research task. “The AI did it” is not an acceptable answer. Neither is “the user started the assistant.”
Imperium is designed around that chain: its product page describes an identity with an owner, a scope and a budget for every human, agent and sub-agent, and authority that narrows as it is delegated. Observatory is meant to provide the investigation trail needed to understand execution.
The risk isn't an AI agent making a decision. It's the organization losing the ability to name who had the authority to make it.
Tracston works on these questions in Imperium and Observatory.
