Authority is treated as fixed. It shouldn't be.
The assumption autonomous agents break.
Most architectures grant authority once and let it stand until revocation.
Traditional security architectures largely treat authentication and authorization as distinct events: establish identity, issue authority, then permit activity until expiration or revocation.
Autonomous agents challenge that model. An agent may operate for extended periods, interact with many services, delegate to further agents, hold credentials across systems, and act long after the original authorization event.
Northgate Cryptography's research examines whether authority itself should become continuously stateful — changing as confidence in the originating authority, device, operating context, or agent behavior changes.
Trust evaluated continuously, enforced at runtime.
In a continuously stateful model, identity signals feed an ongoing trust assessment rather than a single gate. Authorization becomes a live state that tracks that assessment, and the authority an agent carries is bound to the current verified state of the human or organization that delegated it — not frozen at the moment of delegation.
Enforcement moves to runtime: before an agent acts, the system re-checks whether the authority behind that action still holds. When confidence drops — a device falls out of posture, behavior drifts, context changes — authority narrows or fails secure, without waiting for an expiry window.
A series of technical articles on agent authorization, delegated authority, pre-execution enforcement, and continuous authentication is in preparation.