Exhaustibility as a First-Class Invariant

Artificial intelligence is scaling. Automation is scaling. Agent autonomy is scaling. Authority is not.

The central safety problem of the agentic era is not intelligence, model accuracy, or even identity. It is standing authority: a durable permission that allows actions to occur without fresh authorization at the moment they produce effect. Most digital systems today assume that once authority is granted, it may persist. A session remains active. A token carries scope. An API key authorizes repeated calls. A role confers ongoing permission. Revocation is treated as the corrective mechanism.

That model worked when humans were the primary executors of action. It becomes fragile when systems operate continuously at machine speed. The critical question is no longer “Who has access?” The real question is “Should this exact action produce an effect right now?” To answer that safely, we need a new invariant. We need exhaustibility.

Modern authorization frameworks are built on reusable capabilities. A token represents delegated scope. A role represents a class of permissions. A session represents authenticated continuity. Even when the scope is narrow and carefully designed, it persists across time.

This introduces structural risk. Persistent authority accumulates exposure. Attackers can replay it. Over time, it can outlast the assumptions under which it was granted. Operators can exercise it in ways the organization did not anticipate at the time of issuance. For static users operating at human speed, this model is manageable. For autonomous systems acting at scale, it becomes dangerous. Standing permission becomes ambient power.

The problem is not that access control is wrong. It was never designed to constrain machine-speed autonomy at the moment of effect.

What if authority did not persist? What if authority behaved like energy in a closed system, activated under defined conditions, consumed immediately, and incapable of accumulation?

Exhaustibility means that authority exists only at execution. It is instantiated per action, and consumed at execution. It cannot persist. It cannot self-expand. No system can replay it. This principle has deep roots in legal doctrine: courts have long reasoned with exhaustion as a structural property of rights, once exercised, a right is consumed and cannot be reasserted, regardless of any restrictions the holder purports to impose.1 The doctrine operates automatically upon the authorised exercise of the right, rather than as a contractual limitation placed on it.2 The same structural logic applies to authority in autonomous systems.

Authority is no longer treated as a property of identity or as a durable entitlement. It becomes a transient condition that must be freshly satisfied every time an effect is about to occur. This is not a feature. It is an invariant.

Access control answers a specific question: does this identifier have scope to perform this class of actions? That question governs admission. Exhaustible authority answers a different question: is this exact action admissible right now under these constraints, and if so, consume the authority immediately? That question governs effect.

Access is about categories of permission. Exhaustibility is about the admissibility of a specific action in a specific context at a specific moment. Access is durable. Exhaustibility is perishable. Access governs who may attempt. Exhaustibility governs whether an effect may occur. The shift is subtle but foundational: trust moves from identifier continuity to action admissibility.

Autonomous systems introduce continuous operation, cross-domain interaction, high-frequency execution, and independent decision loops. They recombine data, capabilities, and context at machine speed. In such systems, persistent authority multiplies risk. Even narrowly scoped permissions can be exercised repeatedly, rapidly, and across contexts. Revocation becomes reactive. Oversight becomes post hoc. Exposure scales with uptime.

Exhaustibility interrupts that accumulation. If authority must be instantiated per action, evaluated under explicit constraints, and consumed at execution, the risk surface changes fundamentally. There is no standing power to exploit, no reusable privilege to escalate, no authority to accumulate. Each action must stand on its own. This is containment at the boundary of effect.

Exhaustibility is not achieved by tightening scopes or shortening token lifetimes. It requires structural change.

• Authority must be minted per action under deterministic conditions.
• Constraints must be evaluated at the execution boundary, not only at session start.
• The system must consume authority immediately upon effect.
• No component may expand its own authority without fresh origination.
• Every externally observable effect must trace back to a single exhaustible activation event.

In such a system, capability may persist. Infrastructure may persist. Agents may persist. Authority does not. It exists only in the narrow interval between admissibility evaluation and effect production. Accountability artifacts, logs, and receipts follow the exhaustion of authority, not the other way around. This enforces clear causality between authorization and consequence.

CI/CD deployment tokens. A CI system is granted a scoped token allowing it to deploy artifacts to production. The scope is narrow: it cannot access customer data or modify identity policy, only push approved builds to specific services. The token persists. Over time, the environment changes; new services are introduced, dependencies evolve, the threat landscape shifts. One day, a compromised dependency enters the build chain. The pipeline executes as designed. No privilege is escalated, no policy is bypassed. The action is fully authorized.

The failure is not excessive scope. It is temporal drift. The question that mattered was never asked: should this exact deployment, under these exact conditions, produce an effect right now? Under exhaustible authority, the pipeline holds no standing deploy credential. Authority is instantiated per deployment event, and integrity constraints, provenance, and runtime posture are evaluated at execution. The pipeline may persist. Authority does not.

Corporate expense approval. A company grants a senior manager authority to approve expenses up to $50,000, a legitimate, role-based permission that persists as long as the role persists. Over time, liquidity tightens, a division enters restructuring, a vendor relationship becomes legally sensitive. One afternoon, the manager approves a $42,000 contract renewal. The action is procedurally valid. But the approval is materially misaligned with present reality.

The risk is not corruption. It is continuity. Under exhaustible authority, each material expense requires approval authority to be instantiated at the moment of action, with current liquidity posture, restructuring flags, and risk constraints evaluated at execution. The role persists. Authority to produce a financial effect exists only if present conditions justify it.

Identity frameworks remain necessary. Authentication remains necessary. Access delegation frameworks remain useful. But identity answers who. It does not determine whether a specific action is lawful in the moment.

Exhaustibility does not replace identity systems. It introduces a different safety invariant. Identity can govern admission. Exhaustibility governs effect. The distinction is not about scale. It is about primitive mechanics. Reusable delegated scope and exhaustible action-bound authority are fundamentally different constructs. One assumes persistence. The other prohibits it.

Systems built on standing permission assume contextual stability, bounded execution speed, and predictable behavior. Autonomous systems invalidate those assumptions. Context shifts. Conditions evolve. Drift is constant. Exhaustibility restores boundedness in the presence of drift. When authority cannot accumulate, exposure cannot accumulate. When authority cannot persist, misalignment cannot compound. When every effect requires fresh evaluation at the boundary of execution, trust becomes structural rather than rhetorical.

The next generation of infrastructure will not be defined by stronger credentials or broader federation. It will be defined by whether authority can be exhausted at the point of action. Exhaustibility is not an enhancement. It is not a feature toggle. It is not a user experience pattern. It is a first-class invariant. Without it, persistent authority will carry yesterday's assumptions into tomorrow's decisions, and autonomy will outrun control.

1. Impression Products, Inc. v. Lexmark International, Inc., 581 U.S. 360 (2017). Controlling US Supreme Court authority on the doctrine of exhaustion in patent law, establishing that once a right is exercised upon an authorised sale it is consumed and cannot be reasserted. Cited here by analogy to the structural principle that authority is exhausted at the moment of exercise.
2. Quanta Computer, Inc. v. LG Electronics, Inc., 553 U.S. 617 (2008). Foundational Supreme Court reasoning on exhaustion as a structural doctrine rather than a contractual limitation, establishing that the doctrine operates automatically upon authorised exercise of rights.