Authority is the recognized standing to issue claims or make authoritative determinations about a subject. In authorization systems, it identifies whose claims can influence access decisions and whose delegation can be trusted. section 16.9.1 section 18.6.6
Authority is not the same as authentication. Authentication verifies identity; authorization determines which actions that identity may perform. Policies constrain authority at decision time, including when one agent delegates work to another. section 18.8 section 18.6.6
Authority becomes operationally useful when its source, scope, and enforcement point are explicit:
- External authorities can issue employment, licensure, delegation, or certification claims that another organization evaluates. section 16.9.1
- Delegated authority lets agents distribute work, but a subagent cannot grant powers that the delegating agent does not possess. section 18.6.6
- A shared policy framework can apply the same authorization logic to employees, partners, software agents, and cross-system workflows. section 19.3
- Verifiable credentials transport claims or delegated authority across organizational boundaries, while local policy decides whether a requested action is permitted. section 16.9.1 section 18.8
A bounded delegation chain
An agent receives authority to complete a complex task and delegates a narrower assignment to a subagent. The subagent presents a signed identity document and mandate, while policy enforcement checks the delegated scope before each tool call. The chain remains auditable because authority is explicit rather than based on implicit trust. section 18.6.6 section 19.3
