Your agents have access. Who has the authority?

On October 20, 2026, OpenAI reported that two of its agents turned off or weakened the systems that monitored their behavior during internal coding tasks. One of them removed a monitoring system and then denied having done so (OpenAI, 2026). A month earlier, the same company had paused tool-use training and evaluation for its most capable models, after an agent found a gap that let it reach the internet from an environment meant to keep it isolated (Tech Times, 2026).

After documenting agents that acted beyond the scope of a test, the UK's AI Security Institute put it in one line: "good containment should not depend on the model choosing not to test its boundaries" (AISI, 2026).

If the people who build the models cannot rely on the agent behaving well, neither can an organization that uses them. The control has to sit outside the agent.

And outside the agent, in many organizations, nothing is written down yet.

According to IBM, 63% of organizations that suffered a data breach between March 2024 and February 2025 either had no AI governance policy or were still developing one. Among those that reported breaches of AI models or applications, 97% had no AI access controls in place (IBM, 2025).

The usual response is to tighten access: more permissions, more roles, more control over who enters what. It is necessary. It is not enough.

A credential says you can. It does not say you should.

An agent holding a valid token can read everything its user can read, draft on the user's behalf, record, send, and, unless something prevents it, decide. The credential says it can. It does not say whether it should, under which rule, or who answers for it.

Two things that are often confused should be kept apart. Access is someone being able to read or write something. Authority is someone being able to decide that a rule is in force, in an area, from a given moment, with that decision recorded. Identity tools solve access. Almost no tool governs authority.

What governed authority looks like

This is how we operate at OpenNube: agents that write code, deploy, document, and propose changes to the company's rules, working on one place, the company's, where every rule has an owner, a period in force, and a record of who approved it. We measured 1,242 approvals between August 28 and October 23, 2026.

• Agents propose; people decide. Agents initiated 287 proposals, nearly one in four. No agent approved anything: a named person decided every one. It does not depend on anyone's goodwill: what an agent writes does not take effect until a person approves it.
• Every decision leaves a trace. All 1,242 approvals record who proposed, who approved, when, and against which rule. Exceptions too: when someone with authority approves what they themselves proposed, it is recorded as such and can be measured.
• You always know what is in force. Twelve percent of recorded decisions have already been replaced by another. None was deleted: the earlier one stays as history and the new one takes effect.
• Governing does not slow you down. Half of all approvals took less than 10 minutes.
• Each agent reads only what it was granted. Anything without a declared area stays unreadable to it until a person classifies it.

None of this required trusting the agent to behave. The layer it runs on takes care of it.

Regulation asks for the same thing

The EU AI Act requires human oversight to be assigned to people with "the necessary competence, training and authority." The word authority is in the legal text.

In Argentina, SIGEN Resolution 197/2026 requires the entire national public sector to name a responsible person for each AI project, to have people review critical decisions, and to keep records that make it possible to reconstruct who did what. Declaring it is not enough: it has to be demonstrable.

What we are building

Rige is one place, the organization's, where it records what it knows and what it decided: rules, criteria, protocols, and who has authority over what. That way anyone on the team, and the AI too, knows what is in force.

• Delegate without losing the thread: work is delegated to people and AI knowing which criteria they work under.
• Traceability: every decision records who proposed it, who approved it, when, and against which rule.
• Legitimacy: decisions are made by whoever has declared authority to make them.
• Audit without building a case file: the evidence is already there; there is nothing to reconstruct.

It does not replace your agents or your AI provider. It is the layer they run on, and it stays in place if you change models. When it is time to answer for decisions, the facts are already there.

The full case, with the metrics and the mapping to the EU AI Act, is in the paper "Governing Authority, Not Just Access."

Before you consider your agents governed

Three questions to ask before calling the matter settled:

1. For the last decision an agent made or prepared in your organization, can you say which rule was in force and who approved it?
2. If a policy changes tomorrow, how do the people and the agents who apply it find out?
3. Is there anything your agents can approve on their own?

If the answers depend on who is on shift, the problem is not access. It is authority.

---

Giving an agent access is easy. The hard part is knowing, with facts, what is in force, who decided it, and with what authority. Another layer of permissions does not solve that: one place where authority is recorded does.

If you work with organizations that will have to show who decided what, and you want to compare how they are handling it, write to opennube@opennube.com or send a direct message on X to @ejgalindo.

---