What exactly are we governing?

An AI agent can stay below its authorization limit and still exceed it. The reason is simple: it may not act alone.

The Financial Stability Board recently published responses to its consultation on Sound Practices for Responsible Adoption of AI. Several point in one direction: stronger identity controls, delegated authority, traceability, runtime enforcement, and the ability to halt autonomous activity.

But they leave one question open. What exactly are we governing? An individual agent? An agentic workflow? An orchestration platform? Or the complete delegation tree?

It matters because production systems can use an orchestrator to create short-lived sub-agents that split a task, invoke different tools, and vanish in seconds. Governance built around persistent, individually registered agents does not fit cleanly.

Bidun Group’s response argues that the governed unit should often be the delegation tree, not the individual agent. Three points:

1. Anchor identity at the orchestration boundary. The orchestrator is the persistent, registrable system. Sub-agents operate as delegated identities under it, with scoped, time-limited credentials. The record that matters is the delegation event: which parent created which child, for what purpose, and with access to what.

2. Prevent privilege escalation through spawning. A sub-agent should never acquire permissions beyond its parent’s certified boundary, or spawning becomes an escalation path. Least privilege must bind the whole delegation tree, not each child alone.

3. Apply authorization thresholds to aggregate activity. Say an agent needs extra approval for transactions above $1 million. If the threshold applies per action, an orchestrator can divide a $1.2 million objective into three $400,000 actions across sub-agents. No single action crosses the line. The aggregate effect does.

Controls should consider the aggregate effect of the delegation tree over an appropriate time window, not each action alone.

Other respondents reinforce parts of this direction. JPMorganChase called for agent identity, delegated authority, least privilege, multi-hop traceability, runtime enforcement, circuit breakers, and human override. Certavixx Technologies argued that the unit of assurance should extend beyond the model to the full “delegated decision-and-action system.” The South African Insurance Association described orchestration as a distinct control point.

That is meaningful convergence. Yet among the responses I have read, none addressed authorization thresholds being defeated through decomposition across sub-agents.

Written for compliance and risk readers in regulated financial firms. Informational, not legal advice; Mike Bidun is not a lawyer.