Can Is Not May: Authority Models for Governable AI Agents

Abstract

AI agents act through tool-use frameworks that often prove capability while leaving authority implicit. This paper introduces authority models: deterministic, external policy engines that evaluate each governed tool call against a seven-parameter May judgment before execution.

The paper formalizes capability-authority independence: the principle that whether an agent can perform an action provides no information about whether it may. All four cells of the Can x May product are realizable, and any system conflating can with may admits privilege escalation by capability acquisition.

Three formal properties are proven: Can/May Separation, Deny-Monotonicity, and Escalation Monotonicity. AuthorityBench evaluates five enforcement conditions across 54 scenarios, four LLMs, and 7,427 trials. Under ambient social pressure, prompt-only baselines permitted unauthorized actions in 18.3% of sampled trials. The authority model recorded zero observed violations in this benchmark: by architecture, not by model behavior.

Key results

Violation rate under ambient social pressure (P2): the realistic threat where context makes a violation seem natural without explicit prompt injection. Aggregate across 4 models.

AuthorityBench

54 authorization scenarios across six categories, each tested at three adversarial pressure levels: benign (P1), ambient (P2), and adversarial (P3). Four LLMs from two provider ecosystems. All scenarios include ground-truth labels and argument-level authority constraints.

What this means

Prompts are suggestions, not enforcement. System prompt instructions, keyword filters, and alignment training all reduced violations on average in the sample, but did not eliminate them. Under ambient social pressure, the tested prompt-based approaches permitted unauthorized actions at nonzero rates across the evaluated models.

Deterministic interception: evaluating each governed tool call against explicit policy before execution, outside the LLM's inference path, was the tested approach in this benchmark sample with no recorded unauthorized actions across the tested models, scenarios, and pressure levels. Not because the models always behave well. Because the tested architecture did not give them the choice on the governed path.

This is the research foundation behind Veto's architecture: declarative policy, runtime interception, human escalation. The open-source SDK is the reference implementation described in Section 5 of the paper.