An institution can make an action technically possible without making it legitimate. That distinction is easy to accept in the abstract and surprisingly easy to lose when a successful demonstration becomes a procurement decision.
Mohammed Salah and colleagues’ peer-reviewed Perspective, published on 9 September 2026, examines this problem for government AI agents: systems that pursue objectives through connected actions. It is a conceptual argument, not evidence that a particular governance arrangement works. Its central question concerns the continuing connection between public authority and actions selected after an initial objective has been approved.
The authors distinguish permission in software from an institution’s entitlement to authorise an action. They identify risks when mandates become operational instructions, work is delegated again, actions disperse across systems, and opportunities to contest decisions arrive too late. Their proposed safeguards include bounded mandates, inherited permission limits, action-level records, named institutional responsibility and the capacity to stop operations and provide reversible redress.
The useful move is from approving a system to examining what happens during its operation. A procurement committee can assess a product once; the institutional meaning of its actions may change with the task. Consider a hypothetical permit service: helping someone assemble evidence is different from deciding that evidence is insufficient, and different again from changing the deadline by which the applicant must respond. A smooth interface can conceal these transitions. This is an illustration of the review’s question, not a reported deployment or legal judgement.
The paper’s strongest contribution is therefore a distinction that can discipline practical enquiry. A log showing who invoked a tool cannot, by itself, establish why the resulting action was within an organisation’s remit. Yet the novelty should not be overstated. A plausible alternative reading is that familiar problems of administrative delegation and discretionary power have acquired a more complicated technical interface. On that reading, existing institutional safeguards need better implementation; a new category of democratic failure may add little.
That objection deserves a test rather than a rhetorical answer. In a pilot, could investigators compare an ordinary delegation-and-oversight review with a review organised around changing action sequences? The important result would not be a longer risk register. It would be consequential, unauthorised changes that one approach detects and the other misses, with disagreements independently assessed. If both approaches identify the same problems at similar cost, the new formulation may be useful language without being a distinct explanatory advance.
My Autopoietic Ecology reading adds a further question: what keeps correction possible after the pilot ends? The public Concept Guide distinguishes the continuation of an activity from the renewal of the conditions on which it depends. Applied here, an appeal button is not yet an effective appeal. Someone must understand the record, have time to investigate, be empowered to change the outcome and be able to reach the affected person.
This shifts attention towards costs that a technically tidy control scheme might leave outside its frame. Who absorbs the work when an action crosses organisational boundaries? Can a person contest it without repeatedly reconstructing their case? Do staff have enough authority to repair the problem, or only responsibility for answering complaints? These are my proposed extensions, not findings established by the paper.
The same questions must remain open to contrary evidence. If clear mandates and well-designed permission controls reliably prevent harmful overreach across services with very different staffing and repair resources, an AE account centred on those resources would need narrowing. Conversely, if identical controls produce different outcomes depending on who can interrupt, interpret and repair them, that would strengthen the case for studying institutional conditions alongside software behaviour.
The practical implication is modest but demanding: do not let a successful execution stand in for a justified exercise of public power. A worthwhile pilot should make that distinction examinable—and should budget for the people who will have to act on it.
Reference: Salah, M., Abdelfattah, F., Al Araimi, A. and Al Sayed Noor, A. (2026). “Before agentic AI scales in government: the democratic authorization gap”. Frontiers in Political Science, 8, 1956489. https://doi.org/10.3389/fpos.2026.1956489.
Cambridge EdgeLab is an independent research initiative. This review represents Steven Watson’s critical interpretation and does not imply endorsement by the article’s authors, the University of Cambridge or any other institution.
Leave a Reply