Reasoning and authority are different planes
An agent may determine what action appears useful, but the platform must still determine whether that action is permitted. Keeping reasoning separate from authority prevents model behavior from becoming an implicit security policy.
Delegation needs an evidence trail
Enterprise agent actions should preserve the initiating identity, delegated scope, audience, policy decision, tool invocation, result, and relevant evidence. That chain allows organizations to answer not merely what happened, but under whose authority it happened.
Platform architecture has to absorb the problem
Agent security cannot be solved entirely inside prompts or orchestration frameworks. Identity systems, policy decision points, tool gateways, runtime enforcement, audit evidence, and human approval patterns all become part of the platform architecture.