A new governance gap is emerging as enterprises deploy AI agents that can execute actions, not just recommend them. Content filters and guardrails can block unsafe output but cannot determine whether an agent was authorized to issue a refund, touch a production system, or commit the company to an external action. An agent can follow instructions perfectly and still take an action the business never sanctioned, such as calculating a correct refund amount without a boundary preventing credits above what was approved, or identifying the lowest-cost supplier without defined authority to accept contractual terms. These are not necessarily AI reasoning failures but failures to separate technical capability from business authority. Every production agent needs explicit decision rights: what it may execute, what requires approval, what it may only recommend, and what it must never touch. A guardrail is not an authority model. In April 2026, a Cloud Security Alliance survey found that 65% of respondents had experienced an AI-agent-related incident in the prior year, while 82% had discovered previously unknown agents operating in their environments. The survey involved 418 IT and security professionals and was sponsored by Token Security. The World Economic Forum’s May 2026 playbook introduces an Agent Capability and Authorization Profile to make delegated actions auditable, enforceable and accountable. Before an agent receives access to enterprise tools, it needs a machine-enforceable record of delegated authority, called an Agent Authority Contract, which should answer seven questions including who owns the outcome, what the agent may do, and which systems and data