When an AI Can Move From Recommending an Action to Executing It
A convincing response is not authorisation. Before connecting AI to an API, separate recommendation, proposal and execution, then define permissions, confirmation, logging and reversal.
An AI can say “cancel this subscription” or “send this email.” That is text. It is different from being able to call an API, modify a record or send the message. Mixing them turns a persuasive response into implicit authorisation.
The useful routine has three steps. Recommendation: the model offers an option and changes nothing. Proposal: it prepares a specific action —recipient, amount, date or change— for review. Execution: an integration uses a real permission and changes an external system. Risk rises at every step.
OAuth 2.0 documentation explains that a token grants resources and operations defined by scopes. An agent does not gain permission because its explanation sounds reasonable: it can execute only what the token permits. Least privilege reduces possible harm if it misreads an instruction or encounters manipulated information.
Before automating, ask four questions. Scope: can it read, propose, or also write and delete? Confirmation: is the action reversible, routine and low impact, or does it require human approval? Logging: is there a record of instruction, data used, permission and outcome? Reversal: can the effect be undone, paused or limited?
Good design does not use one rule for everything. An agent can summarise invoices without paying them; draft an email without sending it; create a purchase request that a person approves. Human confirmation is not decorative when error is costly or hard to reverse.
The NIST AI RMF organises work around governing, mapping, measuring and managing risk. For agents, that means defining who answers for an action, its context, measured failures and how it is stopped or corrected. The Generative AI Profile does not certify an integration: it reminds readers that risk depends on use case.
AI can be useful without receiving the system keys. The right question is not “can it do this?” but “what minimum permission does it need, who confirms the step, and what happens if it is wrong?”
Primary sources: NIST AI RMF, NIST Generative AI Profile and OAuth 2.0.
This article was produced with artificial intelligence under human editorial oversight.
