Intelligence
Join the waitlist
AEW-001

Action without applicable policy

A consequential action executes although no policy establishes that it is permitted. The control that should apply is absent, not merely bypassed, so nothing stands between the decision and the effect.

Status: publishedExecution AuthorityApproval Controls

Description

This is the base case of execution authority failure. An agent reaches an action whose consequence is real, and there is no policy, gate or check that governs whether that specific action may proceed. The failure is structural: the question of authorization is never asked, because nothing in the system is positioned to ask it. It differs from a bypassed control, where a gate exists and is evaded, and from a mistaken approval, where a human says yes to the wrong thing. Here the action simply runs, because the path from decision to effect was never mediated. The weakness recurs wherever an agent holds the technical capability to act and the deployment assumes the objective, the model's judgment, or the surrounding tooling will supply the missing restraint.

The authority gap

The acting system holds the capability to perform the action but no applicable authority governs whether it may. Capability stands in for authorization because nothing else does.

Failure conditions

  • An agent can execute a consequential action directly, without an intervening authorization decision.
  • No policy names the action as one that requires approval, and no default denies it.
  • The only restraint present is an instruction to the model, which competes with the objective rather than binding the action.

Consequences shown by the evidence

  • Irreversible destruction of data or infrastructure executed with no second decision.
  • Consequential actions taken against third parties that the operator never contemplated.
  • A safety habit that existed in the workflow stops functioning once execution is delegated.

Detection signals

  • A destructive or consequential operation completes with no record of an authorization step.
  • Post incident analysis finds the safeguard existed only as an instruction the agent could override.
  • The only account of why an action was allowed is that nothing stopped it.

Known examples

  • An AI coding agent deleted a company database and its backups in nine seconds with no confirmation request, having been told the rule it then broke.
  • A gym booking agent cancelled a stranger's reservation because the booking API performed no authorization check on the action at all.
  • Claude Code proposed and ran terraform destroy against restored production state, with no gate between the plan and the execution.
  • NCSC's August 2026 interim advice on agentic AI recommends the corrective in general terms: deny network access by default and allow only what a task requires, rather than assume an agent's judgment or its objective will supply the missing restraint.

Recorded instances