The Machine in the Office

In February 2026, the National Institute of Standards and Technology launched an initiative for AI agents capable of autonomous action. A related concept paper asks how organizations should identify, authenticate, authorize, and audit agents that use enterprise data, tools, and applications.

These questions become institutional once an AI system can send an email, place an order, alter a record, release a payment, or modify code. Access control can determine which systems an agent may reach. The organization must also define which actions the agent is authorized to take on its behalf.

Institutions already manage comparable questions through offices. An office has a defined purpose, reporting line, spending limit, access rights, approval requirements, recordkeeping duties, and process for suspension or succession. The occupant receives authority through appointment to that role.

Applied to AI, the model becomes the occupant of a defined institutional office. This framework gives leaders a practical method for assigning authority, preserving accountability, and determining where an agent may act or must escalate.

Defining the AI Office

Institutions have long separated an office from the person occupying it. A treasurer may retire, a compliance officer may resign, or a judge may leave the bench, but the office continues. Its powers and obligations do not disappear with the incumbent.

That separation tells outsiders whose decisions can bind the institution, limits the incumbent’s authority, preserves continuity when personnel change, and allows an auditor to compare what the officeholder did with what the office permitted.

The distinction is so familiar that it is easy to miss its importance. Institutions do not grant authority merely because someone is intelligent, experienced, or trusted. They create an office, define its authority, appoint an occupant, and preserve a record of the appointment.

AI can be approached in the same way. The model occupies the role, while the organization defines and grants its authority. An AI may recommend, approve, reject, initiate, or escalate under the conditions assigned to that role.

The distinction becomes urgent when AI moves from producing information to taking action. A chatbot that drafts an email or summarizes a report may create accuracy, confidentiality, or reputational risks. An AI agent connected to operational systems introduces another category of risk: it can cause something to happen. It may send the email, place the order, change the record, release the payment, modify the code, or instruct another system to proceed.

Technical identity establishes which agent is present and which resources it can access. Institutional authority establishes why the agent may use those resources for a particular purpose under defined conditions.

Singapore’s Model AI Governance Framework for Agentic AI recommends bounded permissions, traceability, assigned human responsibility, and meaningful approval for consequential actions. An institutional office expresses those requirements in terms already familiar to boards, managers, compliance teams, and auditors.

The AI Office Charter

An office charter written in ordinary language can define seven elements: purpose, access, decision rights, escalation, suspension, records, and succession.

Purpose and access establish the office’s operational boundary. “Prepare routine purchase orders for approved vendors” supplies a clearer mandate than “improve procurement.” The office receives the vendor, inventory, pricing, and budget data required for that task while unrelated payroll, customer, and strategic records remain outside its access.

Decision rights distinguish actions the AI may execute, actions it may recommend, and actions reserved for another authority. The charter should also identify escalation conditions, including monetary thresholds, unfamiliar counterparties, policy conflicts, sensitive customer effects, new jurisdictions, and disagreement between reviewing systems. Each condition should name the human or institutional office authorized to resolve it.

Suspension authority determines who can revoke the agent’s credentials, how quickly revocation takes effect, what happens to pending actions, and how operations continue. Control of the office remains incomplete when suspension depends entirely on the AI vendor.

Recordkeeping should preserve the request, relevant inputs, governing policy, model version, approvals, exceptions, overrides, and resulting action. These records allow a reviewer to reconstruct the decision and the authority under which it was made.

Succession rules govern replacement of the model, vendor, prompt configuration, tools, or data sources. A replacement occupant can begin with limited authority, undergo testing, and receive broader powers as evidence accumulates. The
prior occupant’s authority should terminate through the same institutional process that granted it.

Authority in Practice

Defining an office does not mean granting its full authority on the first day. Organizations can expand an AI’s role in stages, just as they do with people entering sensitive positions.



An AI purchasing system can progress through these stages as its performance is evaluated. It may begin by observing orders, then recommend purchases, prepare orders for approval, and eventually execute routine transactions within its charter. Deteriorating performance can move the system back to a more limited role without removing its useful functions.

Consider an AI purchasing office. Its mandate is to place orders with approved vendors for items already included in an operating budget.

The organization might authorize the AI to act alone on purchases below $10,000. Purchases above that amount require approval from a designated manager. Purchases above $100,000 also require the CFO. A separate transaction-risk system reviews changes in payment instructions, unusual order patterns, sanctioned jurisdictions, and vendors whose status has changed.

The purchasing AI can assemble the order, compare approved pricing, confirm available budget, and submit a qualifying transaction. It cannot add a vendor, change its own spending limit, approve an exception it requested, or disable the risk review. When the risk system and the purchasing AI disagree, the transaction does not proceed until the assigned human office resolves the conflict.

The architecture assumes that models can make mistakes, encounter unfamiliar conditions, or be replaced. A bounded mandate, independent checks, escalation paths, and enforceable limits contain the resulting operational risk.

A monetary ceiling controls only one dimension of authority. The same $5,000 purchase may be routine with an established domestic supplier and unacceptable when it introduces a new counterparty, restricted item, unusual destination, or changed bank account. The office must therefore be defined by several conditions at once: purpose, counterparty, transaction type, cumulative exposure, jurisdiction, risk status, and required approvals.

Separation of duties can extend to automated reviewers. One AI may prepare a transaction while separate systems examine sanctions exposure, fraud indicators, policy compliance, or required approvals. A defined human office resolves exceptions and disagreements before execution.

This structure prevents one person or system from creating a vendor, approving that vendor, releasing payment, and reconciling the account. Automation preserves the institutional boundaries used to contain error, conflicts of interest, and misconduct.

Accountability and Authority Records

Boards and senior management remain responsible for the systems through which regulated institutions act. A Financial Stability Institute report states that they remain ultimately accountable for AI use and calls for clear allocation of responsibilities across the AI lifecycle. For high-risk systems, the European Union’s AI Act also establishes duties involving human oversight, monitoring, and logs.

The office model makes that responsibility clearer. It forces the institution to identify the people who design the mandate, appoint the AI, monitor its performance, approve exceptions, and revoke its authority. It also prevents “the AI decided” from becoming an acceptable explanation.

Institutions preserve accountability for delegated authority through charters, supervision, reporting, review, and removal. AI changes the occupant while leaving those institutional responsibilities in place.

Activity logs record events. Authority records preserve the permissions, limits, appointments, and approvals under which those events occurred.

An activity log may show that a model released a payment at 2:14 p.m. An authority record should also show whether that model occupied the purchasing office at 2:14 p.m.; whether the office was permitted to release that kind of payment; which monetary, geographic, and counterparty limits were in force; whether the transaction required another authority; and whether that approval was present.

A previous Beige Media analysis describes this as the “authority history problem”: proving who was authorized to act at a past moment. The problem becomes more difficult with AI because models, configurations, permissions, and vendors may change faster than traditional organizational roles. Retrospective review therefore requires more than preserving the answer an AI produced. It requires preserving the institutional context that made the answer actionable.

This is also where provable institutional control becomes relevant. Before execution, a system should be able to determine whether the required authorities have approved. After execution, the resulting evidence should allow an independent reviewer to reconstruct why the action was accepted as legitimate.


Separating the office from the AI also prevents operational lock-in. Organizations will change models as performance, pricing, risk profiles, or vendors change. Some will use competing models for resilience or test a challenger alongside the incumbent.

If identity, permissions, approval logic, and evidence requirements are embedded inside the model or vendor platform, changing the model becomes a redesign of institutional control. The organization may discover that it cannot replace the occupant without rebuilding the office.

A durable office reverses that dependency. Its identity and mandate remain stable while the model changes. A replacement can be tested under a limited mandate, expanded as evidence accumulates, or removed without disrupting the surrounding workflow. The organization can then ask a sensible succession question: is this model qualified to occupy this office? That is more manageable than asking whether the organization should “trust AI.”

From Institutional Idea to Technical Architecture

The office model eventually creates technical requirements. The office needs an identity independent of the model. Its mandate and approval rules must be enforceable outside the model’s own reasoning. Appointments, suspensions, and replacements must be recorded. Actions must carry enough evidence for other systems to verify that the required authority existed.

NIST’s agent identity concept paper asks how agents can prove authority, convey intent, support delegation, and bind their actions to human authorization. The office model adds an institutional interpretation: identity establishes which agent is present, while the office establishes the role under which it acts.

The author’s related paper on provable institutional control develops this requirement as a coordination problem between institutional approvals and external execution systems.

The Accumulate whitepaper illustrates one architectural approach by separating a persistent organizational identity from the particular keys, people, or systems authorized to act for it. Authorities and approval paths can change while the identity and its history remain intact. An AI can therefore be appointed to one role, constrained by other authorities, and replaced without reconstructing the organization around it.

Building on that identity model, the CERTEN technical whitepaper extends this principle across transaction environments by coordinating and proving required approvals before an external action is executed. It represents one implementation direction rather than a prerequisite for the office model. The broader requirement exists regardless of platform: authority should remain under institutional control and should not disappear inside the AI or the vendor that supplies it.

Before granting operational credentials, an organization can define the office’s purpose, access, decision rights, required approvals, suspension authority, evidence requirements, and succession process. The model can then be evaluated against a role whose limits already exist.

If the agent later acts incorrectly, the institution should be able to reconstruct why it acted, which authority permitted the action, and who remained accountable. Safe deployment depends on keeping that authority under institutional control as models, vendors, and operating conditions change.

Sources

• National Institute of Standards and Technology. "AI RMF Core." NIST AI Resource Center, 2023.
• National Institute of Standards and Technology. "Announcing the AI Agent Standards Initiative for Interoperable and Secure Innovation." NIST, 2026.
• Harold Booth, Bill Fisher, Ryan Galluzzo, and Joshua Roberts. "Accelerating the Adoption of Software and AI Agent Identity and Authorization." National Cybersecurity Center of Excellence, 2026.
• Infocomm Media Development Authority. "Model AI Governance Framework for Agentic AI." Infocomm Media Development Authority, 2026.
• National Institute of Standards and Technology. "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile." NIST, 2024.
• Juan Carlos Crisanto, Cris Benson Leuterio, Jermy Prenio, and Jeffery Yong. "Regulating AI in the Financial Sector: Recent Developments and Main Challenges." Financial Stability Institute, 2024.
• European Parliament and Council of the European Union. "Regulation (EU) 2024/1689 Laying Down Harmonised Rules on Artificial Intelligence." Official Journal of the European Union, 2024.
• Beige Media. "Governed by Genesis, Part II: Authority as History." Beige Media, 2026.
• Kyle Michelson et al. "Accumulate: An Identity-Based Blockchain Protocol with Cross-Chain Support, Human-Readable Addresses, and Key Management Capabilities." Inveniam DeFi Devs, Inc., 2022.
• CERTEN. "Governance Infrastructure for the Digital Asset Economy: A Universal Protocol for Institutional Control, Compliance, and Execution." CERTEN, 2026.
• Jay Smith. "Provable Institutional Control for Tokenized Finance: Governance Synchronization as the Missing Infrastructure Layer." SSRN, 2026.