AI is growing a spine

In brief

What this examines

The article uses the spine metaphor to explain the shift from AI systems that generate answers to agentic systems that carry intention into consequential action. Once an agent can use credentials, change records, trigger workflows, spend money, communicate externally, retry, or delegate, model quality is no longer the whole design problem. Authority, enforceable controls, evidence, containment, and degraded-mode behavior become load-bearing architecture.

Why it matters

The article distinguishes access from authority and policy from control. A login establishes identity and capability; authority must still bind purpose, scope, delegation, approval, limits, expiry, and revocation to the exact action. Governance is credible only when controls can prevent or interrupt unsafe actions outside the model's own judgment and preserve enough evidence to reconstruct both successful and rejected paths.

Key ideas

• Agentic risk comes from consequential action, not only incorrect output.
• Authentication does not establish the agent's mandate to act.
• Approval should bind to the specific facts, method, amount, destination, purpose, and time window of an action.
• Prompts, policies, and logs do not become governance unless they change what the system can do.
• Evidence must preserve initiating identity, delegated authority, context, policy version, tool calls, retries, approvals, side effects, rejected attempts, and outcomes.
• Runtime thresholds, revocation, circuit breakers, and fail-closed degraded modes must sit outside the agent's discretion.
• One consequential workflow is a better starting point for architecture review than a generic AI policy.

A brain is not an operating model

A model can produce an answer, but an agent can turn an answer into a sequence of events. Once a system can retrieve sensitive information, change records, trigger workflows, spend money, communicate externally, retry, or delegate, the design problem expands from model quality to operational authority and control.

A policy is not a control

Policy can describe what should happen. A control changes what the system is able to do. Approval for a consequential action should bind to the actual customer, amount, destination, method, purpose, facts, and time window so that a retry or changed condition cannot silently reuse authority that no longer applies.

Authority is the part a login cannot solve

Authentication establishes identity and access establishes capability. Neither proves the mandate to act. A credible authority layer makes purpose, scope, delegation, approval, limits, expiry, and revocation explicit for the action being performed.

• Bind authority to a named principal and business purpose.
• Limit the systems, data, transactions, time, cost, volume, and sensitivity in scope.
• Define how delegated authority expires or is revoked, including work already in flight.

Evidence must survive the action

Prompts and final outcomes are not enough to reconstruct a consequential run. The evidence chain should retain the initiating identity, delegated authority, relevant context, policy version, model decisions, tool calls, retries, handoffs, approvals, exceptions, rejected attempts, side effects, uncertainty, and outcome.

The spine needs a reflex

Some boundaries must act before the agent can negotiate with them. Spending thresholds, data-loss controls, revoked credentials, runtime limits, and circuit breakers belong outside the model’s discretion. Degraded-mode behaviour must also be explicit when an approval, policy, or evidence service is unavailable.

Start with one consequential workflow

Begin with a workflow that would matter if it went wrong: a refund, access change, vendor payment, customer communication, record update, or data export. Trace the request, identity, required authority, exact approval, external stop condition, and evidence that remains after success, failure, retry, or revocation.