Most agent stacks excel at turning model output into action but fail to ensure actions are actually allowed. A support agent might correctly choose to cancel a subscription and extract an account ID, yet still cancel the wrong account due to lack of authority checks. Capability (the LLM's ability to select a tool and produce arguments) is distinct from authority (a separately enforced policy permitting a bounded action for an identified principal).
Robust systems treat capability as a proposal requiring authority before effect. Risks like prompt injection, ambiguous intent, stale context, and broad credentials can turn valid tool calls into harmful outcomes, as highlighted by OWASP's agentic system risks. The solution is not more prompt instructions but a deterministic control plane.
Sophisticated agentic systems organize into three planes: planning (model reasoning and tool selection), control (governance: authentication, context resolution, authorization, policy evaluation, and approval), and execution/observation (action invocation, verification, and audit). The control plane authenticates principals, validates actions, evaluates risks, may require exact approval, issues scoped authority, and persists decision evidence. This separation ensures safety and accountability beyond syntactic validity or HTTP success.
Source: Towards Data Science · Summarized by HeadlinesBriefing