Intelligence
Join the waitlist
AEW-003

Execution authority collapsed into capability to prepare

The capability to prepare a consequential change and the authority to make it take effect are held by the same actor, so the review seat that separated them goes empty.

Status: publishedExecution AuthorityApproval ControlsHuman Oversight

Description

Many established workflows separate preparing a change from executing it: a plan is produced, a human occupies the reviewer's seat, and only then is the change applied. That separation is a control only while a different actor consumes the plan than the one that produced it. When an agent is delegated both halves, the review step still appears to exist but no longer functions, because the actor that reasons about the change is the actor that commits it. The weakness also appears when a product carries a change to the very edge of taking effect and describes a human sign off, without any mechanism that prevents the change proceeding if the sign off is absent. Capability to prepare is not authority to enact, and collapsing the two removes the last layer that made the workflow safe.

The authority gap

Authority to prepare a change is treated as authority to enact it, so the separation of duties that made the workflow safe is present in form and absent in effect.

Failure conditions

  • An agent both produces a consequential change and executes it, with no independent actor between.
  • A described sign off has no mechanism that blocks the action when it is missing.
  • The reviewer's seat exists in the workflow but is occupied by the same actor that generated the work.

Consequences shown by the evidence

  • Production infrastructure destroyed because plan and apply were delegated to one agent.
  • A change carried to the edge of production with no enforced gate before it ships.

Detection signals

  • The same actor appears as both author and approver of a consequential change.
  • A sign off is described in product material but no artifact defines what enforces it.
  • Remediation after an incident consists of taking back the execution half rather than removing the agent.

Known examples

  • A developer delegated both terraform plan and terraform destroy to Claude Code; his own fix afterwards was to run destructive commands himself.
  • Slack Code lets an agent assemble a plan, branch, diff and preview and describes an expert sign off before production, with no published mechanism that enforces it.

Recorded instances