SovereignRoot blog
AI agent authorization: the grant layer and the ceiling layer
OAuth, delegation receipts and scope tokens answer "what may the agent do?" A root policy answers "what must it never do?" Both are needed.
Two different questions
When you build an autonomous agent, you need two layers of authorization:
- The grant layer — what the agent is allowed to do. OAuth scopes, delegation receipts, task tokens, child-agent grants.
- The ceiling layer — what the agent must never do, regardless of any grant. A persistent, human-owned root policy.
Why grants aren't enough
Grants are per-task, per-vendor, per-session. They change. A root policy is designed to outlive all of them — it survives model swaps, vendor changes, prompt rewrites, memory injection and delegation chains.
The invariant that binds them
Effective authority = delegated authority ∩ root allowed authority
Decision precedence: DENY > REQUIRE_APPROVAL > ALLOW. A downstream grant can never override a root deny.
Concrete examples
- OAuth says the agent can send mail; the root says external sends require approval → HOLD.
- A delegation receipt allows a £500 transfer; the root has a £100 approval ceiling → HOLD.
- A child-agent token grants package install; the root denies software installation → DENY.
Build the ceiling
SovereignRoot is a working protocol for a portable, cryptographically signed root policy. Generate yours locally — no account, no upload, no backend.