AI development is largely organized around capability. We measure what models can reason about, which tools they can use, how many steps they can complete, and how effectively they can operate without human intervention. But the fact that a system can perform an action does not establish that it should be permitted to perform it.
This distinction between capability and mandate becomes critical in agentic AI. A highly capable system may be able to negotiate a contract, transfer funds, modify production software, contact customers, hire services, or delegate work to other agents. Yet each of these actions involves authority that must come from somewhere. Capability describes technical possibility; mandate defines legitimate scope.
In human institutions, these distinctions are familiar. Expertise does not automatically confer authority, and access does not automatically constitute permission. Autonomous systems require the same separation. Their expanding technical capabilities should not silently expand their decision rights.
Good AI governance therefore requires organizations to specify not only what a system is capable of doing, but what it is empowered to do, under which conditions, on whose behalf, and with what limits. The faster AI capabilities advance, the more important this separation becomes. The boundary of a system's capability should never be mistaken for the boundary of its legitimate authority.