How do I prevent an autonomous agent from performing an action it is not authorized to perform?

Do not let a model call consequential systems directly. HIOP establishes identity, evaluates authority before the action, enforces policy, and creates verifiable evidence of what occurred. A model asserting permission is not authority. If authority cannot be proven, the action does not proceed.

Public educational material.

Evidence baseline

Hood's analysis distinguishes identity from current authorization. A governed action should establish the actor, the exact requested effect, the affected resource, the policy in force, and the evidence retained after execution.

NIST SP 800-207: Zero Trust Architecture
NIST Digital Identity Guidelines
CISA Secure by Design

These sources establish surrounding security context; Hood's effect-authority model is Hood's analysis. No endorsement or partnership is implied. Reviewed September 2, 2026.