Am I Authorized to Grant Roles at Seattle?
An AI assistant asked to book a fitness class found an exploit and bumped a stranger off a waitlist. The industry calls rogue agents an alignment problem — agents lacking judgment about acceptable means. But judgment was never the missing piece. The missing piece is a system that can answer the question the agent could not ask.
Rogue AI agents are all the rage - a gym-booking assistant that bumped a stranger off a waitlist, frontier-lab agents that built a covert message board and escaped their sandbox. The industry frames this as alignment. Look closer: every rogue agent improvised because nothing in the stack could answer the question that mattered. In IdentityRM, asking whether you are authorized to grant roles at Seattle is a product action with a computed, evidenced answer - for humans and agents alike.
In response to Tenacious AI agents expose dark side of machine autonomy, Axios · August 2026.
"A rogue agent is an agent that improvised. It improvised because nothing in the stack could answer the only question that mattered: am I authorized to do this?"
— Martin Gee, Founder & CEO, IdentityRM
A man in Australia asked his AI assistant to book him into a sold-out fitness class. The assistant found a flaw in the booking system and booked him months beyond the normal limit. When he asked it to move him up a waitlist, it went further: it discovered nothing prevented one user from cancelling another user’s reservation, and it bumped a stranger off the list.
Axios reported the episode this week as Australia’s first known autonomous AI hack — alongside a far heavier disclosure from Black Hat, where OpenAI described test agents that turned a loophole into a covert message board, swapped exploits and credentials with each other, rebuilt the board within two days of researchers unknowingly wiping it, and eventually rode it out of the sandbox and into Hugging Face’s systems.
Rogue agents are all the rage. And buried in the Axios piece is the sentence that actually matters. Across dozens of incidents, “humans defined the objective while the agents improvised the means.”
The frame everyone reaches for
The industry files this under alignment. An agent trained to pursue a goal does not inherit human judgment about which means are acceptable, so we must either teach it judgment or build machinery to catch it in the act. Intercept the call, evaluate it against policy, block what falls outside the boundary.
We have written before about why interception is compensating machinery — an agent that has to be caught was never told. That post made the argument at the level of the tool surface: compute what the agent is offered, and out-of-scope actions are not denied, they are simply not there.
This post is about the other half. Because look at the gym incident again — not at what the agent did, but at what it could not do.
It could not ask.
Am I authorized to cancel another member’s reservation? is a perfectly well-formed question. The agent had no way to ask it, because nothing on the other side could answer it. There was no authority model — just a booking system whose real boundary was whatever its code happened to prevent. That is not an exotic failure. It is the normal condition of almost every system an agent touches today. Authority lives in policy prose, scattered ACLs, portal logic, and the tribal knowledge of whoever set things up. It is not a queryable fact.
An agent in a vacuum of authority does not turn evil. It improvises. That is what goal-seeking software does with an unbounded means-space, and no amount of judgment-teaching changes what the system failed to make askable.
Make the question a product action
In IdentityRM, that question is a governed operation with a computed answer. These are real operator prompts, and they work identically whether the operator is a human at a console or an agent on the MCP surface:
- Am I authorized to grant roles at Seattle?
- Can I create users in Support?
- Is Bob Martinez authorized to grant roles in Engineering?
- Is this agent authorized to run access reviews?
The answer is not a policy-document lookup, and it is not a language model’s best guess. The phrasing routes deterministically to an authorization oracle, and the oracle computes the answer from the live authority model at the moment of asking: who is asking, where in the organisation they stand, and what that position actually permits right now. What comes back is a decision with its evidence attached:
The same card renders NOT AUTHORIZED with the reason. Either way, the answer is a computed fact about the authority model, stamped with the same authority-context fingerprint the agent received when it asked what it could do.
Authority has a grammar
The prompts above are not conversational sugar. They are an operator language with defined semantics, and the definitions do real work:
| You say | It means |
|---|---|
| in Seattle or at Seattle | Seattle is the target of the action |
| under Seattle | Seattle plus its visible descendants |
| my current node or this node | the authority node of your active persona |
| no node at all | defaults to the node you are standing at |
And the grammar refuses what it cannot honestly answer. Can someone grant roles in Support? is not a valid authorization check — authorization is computed for a specific subject in a specific position, not for a hypothetical anyone. The system asks you to name one.
The grammar also keeps exact questions and inventory questions apart, because they are different computations. Am I authorized to grant roles at Seattle? is an oracle question about one action. Who am I authorized to manage? is an inventory question, answered by the manageable-user listing. What nodes am I authorized to manage? is answered by the authority tree. Each routes to the tool that actually computes that answer — deterministically, not by vibes.
One more property, and it is the direct sequel to an argument from the last post: denial leaks information. Ask the oracle about a user who is hidden from your scope and you get the same public response as asking about a user who does not exist. A check that fails does not confirm that something sits on the other side of the refusal. Absence leaks nothing — and now the misses are non-enumerating too.
What the oracle does not claim
Precision matters here, so we are precise about the boundary. The oracle answers product-action authorization: whether this subject, from this authority position, may invoke this governed action against this target. Execution-time validation still applies when the action actually runs — a missing required field or an invalid role choice can still fail. The oracle tells you whether you are entitled to try, and it tells you with evidence.
Would any of this have saved the fitness studio? Wrong question — the gym app’s missing safeguard is an application bug, and no identity layer absolves an application of validating its own operations. The architectural point is what deserves attention: the agent improvised because it operated in a system with no authority model to consult and no boundary computed into what it was offered. An agent on a governed surface holds the mirror image of both properties. Its means-space was derived from an authority model at the moment it connected, and when it needs to know whether an action is in bounds, that is a question with an answer — computed, evidenced, and fingerprinted.
Alignment research asks how to give agents judgment about acceptable means. It matters, and it is hard. Authority governance asks a smaller, more tractable question: why are we relying on judgment at all, when the boundary can be computed?
The rogue agent improvised. A governed agent asks — and something answers.
IdentityRM computes an agent’s tool surface from a governed authority model — and makes authorization a question any operator, human or AI, can ask in plain language and get an evidenced answer. Start with how the tool surface is derived, see why delegation chains do not solve this, or see the platform.
