An agent asked to examine an invoice can identify an anomaly, ask another agent to investigate and propose a correction. Delegation becomes dangerous when permission to analyse silently turns into permission to spend. A coherent result and a readable conversation do not establish that the final action was authorised.
This is the problem addressed by PAEA, the Agentic Execution Assurance Profile I propose for assessing sensitive processes. PAEA is a proposed profile, with no status as a standard or certification. Swarm is my experimental environment for parts of these contracts.
One invoice, two agents and an expanding mandate
Consider a finance team authorising an agent to match an invoice against supporting documents. The agent delegates the search for a missing reference. Its delegate finds a note claiming that management approved payment and proposes executing it. If the first agent treats this sentence as permission, documentary content has replaced an authorised decision.
The amount is only one consideration. The beneficiary, resource, current mandate or separation between requester and approver may differ from the conditions of an earlier decision. An arithmetically correct payment can therefore remain unauthorised.
Delegating a task does not give the delegate permission to expand the authority it received.
The commitment request must be checked against an explicit, currently valid mandate. Analysis can continue within its scope; commitment remains pending if a required approval is absent. A new approval must concern the exact action. Neither a convincing explanation nor an old approval is sufficient.
What an assurance profile must connect
PAEA brings together eight proposed requirements. Identity and delegation identify the actor and principal. Admission integrity and memory governance prevent reused content from acquiring implicit authority. Authorisation at commitment and control of access paths bind a decision to the actual resource. Effect and recovery management retain known and uncertain outcomes. Human approval and evidence qualification establish the conditions for proceeding.
These requirements depend on each other. A correct policy decision provides insufficient protection if an agent can access the resource through another tool. A signed identity attributes a request; it does not prove the request is true or appropriate for the business.
Separating rule evaluation, protection of execution capabilities and enforcement at the resource boundary clarifies responsibilities. Drawing three components does not establish independence when they share privileges and bypass routes.
Swarm’s current scope
Current sources contain preparation and validation controls and a Trust reference monitor with simulated effects. This pilot binds actions to a mandate, parameters and a separate approval. It does not establish banking integration or control of every path an agent could use to reach a real system.
Identity contracts remain partial and overall qualification is open. A deterministic engine alone does not establish operating system confinement, secret protection or network isolation. Successful internal checks must not be mistaken for protected human approval or authenticated end-to-end authority.
How to challenge the assurance claim
A useful evaluation would exercise expired mandates, changed beneficiaries, out-of-scope delegation and recovery after an uncertain result. It would observe effects, unjustified refusals and recovery conditions against a defined baseline. No success rate is claimed here.
The objective is to retain verifiable authority as delegation chains grow. The Swarm repository exposes mechanisms and limitations for examination; their presence does not qualify a critical deployment.