Much of the discussion around AI safety has focused on alignment: whether an AI system behaves consistently with human intentions, values, or objectives. Alignment remains important, but as AI systems become capable of acting autonomously, another question becomes equally important: what is the system actually authorized to do?
An AI system can be well aligned and still possess too much authority. It may understand its objective correctly, reason competently, and act in good faith while nevertheless accessing information, committing resources, modifying systems, or making decisions that should have remained outside its mandate. In agentic environments, safety therefore depends not only on whether the system wants to do the right thing, but on whether the architecture limits what it is permitted to do.
This shifts part of the AI governance problem from values to authority. Authorization means translating institutional intent into concrete boundaries around identity, permissions, tools, data, financial limits, decision rights, and escalation. The question is no longer simply whether an AI system is aligned with an organization's objectives. It is whether the authority granted to the system is appropriate to the task, proportionate to the risk, and capable of being withdrawn.
As AI becomes more autonomous, alignment without authorization is incomplete governance.