The Architecture That Keeps AI From Authorizing Itself

TL;DR An AI agent authorization architecture should let the agent propose work without letting it define the conditions that make that work permissible. Separate the runtime, authorization and enforcement, execution credentials, evidence, and human control administration. Protect the policy inputs and deployment paths as carefully as the policy engine itself. A denied action can become an approved