Human Authority
Human Authority for Autonomous AI
Oversight that fires on everything stops being oversight. Keeping human authority real means fewer decisions, better context, and a record that proves who approved what.
What is human authority for autonomous AI?
Human authority is the requirement that a person's decision remains the source of an autonomous system's permission to act. In practice that means the permission is expressed as a machine-readable grant, the grant is evaluated per action rather than per session, and the link from the human decision to the machine action survives as a record someone outside the organization can check.
Almost every organization deploying agents says a human is in the loop. Very few can say which human, for which action, under what authority, and show the artifact. The gap between those two sentences is where most AI governance programs actually sit.
This page is about closing it: why approval queues decay, what escalation is instead, how a human decision becomes machine-readable authority, and how to prove after the fact that a person authorized a specific machine action.
Why does human-in-the-loop approval fail in practice?
Because oversight that fires on everything stops being oversight. When the approval queue is large the person is still present, still clicking, and no longer evaluating, and every metric except the one that matters continues to look healthy. Approval rates near one hundred percent with response times in seconds are the signature of a control that has already decayed.
This is not a failure of diligence and it does not get fixed with training. It is a structural consequence of volume. Ask a person to evaluate four hundred items a day, of which three hundred and ninety-eight are routine, and their behavior will converge on approving by default, because that is the behavior the evidence rewards. The two items that mattered arrive looking exactly like the other three hundred and ninety-eight.
The second failure is subtler and shows up in incident reviews. The human approved something, but what they approved was a summary. The agent's actual action was five levels of indirection below the sentence on the screen. Consent was given to a description, not to an effect, and the record afterward shows an approval that was technically true and substantively empty.
How is escalation different from an approval queue?
An approval queue routes everything to a person. Escalation is a third verdict alongside allow and refuse, reserved for actions that are neither clearly inside granted authority nor clearly outside it. Clear allows proceed and clear refusals are rejected mechanically, so the only decisions reaching a human are the ones where human judgment adds something.
The arithmetic is the whole argument. If the boundary can mechanically clear the routine actions and mechanically refuse the plainly unauthorized ones, the queue shrinks by an order of magnitude or more. What remains is a small set of genuinely ambiguous cases, arriving with enough context to be evaluated, at a rate a person can actually read.
Mechanical refusal is what protects human attention. Every action the boundary refuses on its own is an action nobody had to look at, and a refusal that costs no human attention is one that never decays.
Turning a human decision into machine-readable authority
The reason approvals evaporate is that most of them are prose. A decision made in a meeting, recorded in a ticket, implemented as a config change, and referenced later by memory. Each hop loses precision, and none of the artifacts is the authority itself.
A grant is that decision written in a form the enforcement path can evaluate. It names the operations it covers, the parameter bounds those operations may carry, the targets they may act on, the conditions that must hold, and when it expires. It is identified by the hash of its content, so the question "what did that grant say at the time" always has exactly one answer.
This changes what a human approval is for. Instead of approving individual actions forever, a person approves a bounded envelope once, with an expiry, and the boundary enforces that envelope on every action inside it. The human decision becomes durable and checkable rather than momentary and recalled.
It also makes over-broad authority visible. A grant that has to be written down as "any operation, any target, no bounds, no expiry" is a sentence most approvers decline to sign, and that is the correct outcome. The exercise of writing grants is frequently the first time an organization sees what its agents were actually permitted to do.
How do you prove a human approved an AI agent action?
The approval has to be part of the authorization decision rather than a separate ticket. A signed receipt names the grant the action ran under, that grant's content hash, and, for an escalated action, the human verdict that released it. Reconstructing approval from a config change, a chat message, and a deploy log is inference. A receipt is a record.
The distinction matters most at the moment it is hardest to satisfy, which is an investigation months later. At that point the policy has been edited, the ticket references a version that no longer exists, and the person who approved has moved teams. Inference across those artifacts produces a narrative, and a narrative is not evidence.
A receipt carries the chain in one artifact: the canonicalized action, the subject, the grant identifier and its content hash, the policy version, the rule trace gate by gate, the verdict, and an Ed25519 signature over the whole record. An escalated action produces its own receipt when the human verdict resolves it, chained to the receipt that raised the escalation, so the approval and the action it released are linked in the evidence rather than correlated across two systems afterward.
And it works for refusals. An organization that can only prove what it did, and not what it declined to do, cannot demonstrate that human authority was bounding anything during the period when nothing went wrong.
What does the EU AI Act require for human oversight?
Article 14 requires that high-risk AI systems be designed so that natural persons can effectively oversee them, including the ability to interpret output, decide not to use the system, and intervene or interrupt it. Article 12 requires automatic recording of events over the system's lifetime. Read together, the obligation is not only that a human can intervene but that the record shows whether oversight was real.
The word carrying the weight in Article 14 is effectively. A screen with an approve button satisfies the literal text and fails the standard, because oversight that has decayed into clicking yes is not effective oversight in any sense a supervisor would accept. The provision also names automation bias explicitly as something the design must address, which is unusual and worth noticing: the regulation anticipates the exact decay described above.
Article 12's logging obligation is where receipts stop being a nice property and start being the compliance artifact. Records that can be edited by the system that wrote them are weak evidence of anything. Records that are signed at decision time, chained so removal is detectable, and verifiable offline are the form that survives being handed to a supervisory authority.
Measuring whether oversight is still real
Human authority is testable, which means it should be tested rather than asserted. ExecLayer publishes two instruments and they cover different halves of the problem.
AGB, the Agentic Governance Benchmark, scores runtime governance capability across six weighted dimensions: policy determinism, enforcement latency, receipt provenance, scope containment, jurisdictional enforcement, and override integrity. The composite maps to a maturity tier from Ungoverned to Sovereign. The published paper presents a self-assessed reference implementation and recommends independent third-party assessment to strengthen its evidentiary value.
OHB, the Override Health Benchmark, asks whether human authority remains operationally real: whether override capability is durable, timely, and meaningful as autonomous systems push toward action, rather than nominally present and practically decayed.
A high capability score does not guarantee good governance outcomes. A perfectly enforcing kernel with a rubber-stamped escalation path is bounded by policy and not by anyone's judgment. A vigilant human attached to a system that acts before they can intervene is oversight in name only.
Authority is the thing that has to be delegated carefully
The framing that makes this tractable is old and predates AI entirely. Organizations have always delegated authority to agents who act on their behalf, and the mechanisms for doing it safely are well understood: bound the mandate, write it down, put an expiry on it, require a record, and keep the principal accountable for what the agent does inside it.
What is new is the speed and the volume, which breaks the assumption that a human can stay attached to each action. The response is not to abandon the model but to mechanize the parts that scale badly. The grant is the written mandate. The boundary enforces it on every action. The receipt is the record. Escalation is what happens at the edges of the mandate, where a person is genuinely needed.
Under that arrangement autonomy expands rather than contracts, because the ceiling on what an organization will let an agent do is set by the blast radius of the worst unsupervised action. A boundary that provably bounds the worst case removes the reason for the ceiling. Bounded autonomy is what makes broader autonomy grantable.
Evidence and further reading
The architecture described here is published and citable. ExecLayer holds seven provisional patent filings covering deterministic governance enforcement, authority receipts, runtime policy bundles, and governed agent supply-chain control.
- Benton, J. Deterministic Runtime Enforcement Architecture, Foundational Trilogy. Zenodo Record 18749299.
- Benton, J. The Agentic Governance Benchmark, scoring methodology. DOI 10.5281/zenodo.20496565.
- Benton, J. Foundational thesis on execution-bound governance. SSRN Abstract 6290760.
- Regulation (EU) 2024/1689, Articles 12 and 14. eur-lex.europa.eu
- Kaptein, M., Khan, V.J., Podstavnychy, A. Runtime Governance for AI Agents: Policies on Paths. arXiv:2603.16586 (2026). arxiv.org/abs/2603.16586