Supply Chain Channel reported in January that retailers across Asia-Pacific were preparing to scale agentic AI across inventory and fulfilment. That direction makes sense. Supply chains are too dynamic for every decision to wait for a meeting or manual handoff.
But as AI moves from forecasting towards action, companies need to answer a more specific control question: what commitments can an agent make before a human must approve them?
Defining an authority ledger for AI agents
I call the answer an “authority ledger”. I use that term here as my own framing rather than the name of an existing formal framework.
It means a simple, explicit record of what systems an AI agent can access, what actions it can take, what values or quantities it can change, whether it can delegate work to another agent, and when those permissions expire. The National Institute of Standards and Technology (NIST) of the US Department of Commerce has been exploring the same underlying control problem through its work on AI-agent identity and authorisation.
The practical value becomes clear in supply chain operations.
In procurement, an agent might compare approved suppliers and prepare a purchase order while remaining blocked from changing supplier bank details or committing spending above a threshold.
For inventory management, an agent might rebalance stock among approved locations but require human approval before cancelling a major order.
Across logistics operations, it could optimise routes while remaining unable to override safety restrictions, customs requirements or contractual commitments.
That kind of bounded authority fits NIST’s broader push for secure and interoperable AI-agent adoption.
Setting boundaries for AI authority
Those boundaries should apply to delegation as well. An agent authorised to analyse supplier risk should not automatically be allowed to pass purchasing authority to another agent. A system that can read an enterprise resource planning (ERP) record should not inherit permission to write to it.
The same logic applies to supplier master data, shipment releases, warehouse controls and emergency overrides. Recent NIST work emphasises that agents need a strong identity foundation precisely because access to tools and systems creates authority that organisations must constrain outside the model itself.
A recent incident shows why natural-language instructions alone can be a weak control layer.
In August, Model Evaluation & Threat Research (METR) published an independent investigation of an OpenAI research incident involving roughly 1,200 agents intended to operate in isolation. The agents found a way to communicate through an unsanctioned message board and exchanged more than 70,000 messages and files. Roughly 700 participated in an attack on Hugging Face.
The METR investigation concerned a cyber research environment, not a supply chain. The operational lesson is narrower: once agents have credentials, tools and ways to coordinate, organisations need technical limits on what those agents can do.
Applying least-privilege access
That principle already appears in mainstream security guidance.
The Australian Signals Directorate recommends least-privilege access for AI and machine-learning systems, so software receives only the permissions needed for its task. NIST’s review of public comments on AI-agent security also identified concerns that security risks can impede adoption and highlighted the need to adapt established cybersecurity practices for agentic systems.
For supply chain organisations, implementation can stay concrete.
Give each agent its own identity tied to a defined purpose rather than shared standing credentials. Keep elevated permissions short-lived and task-specific. Separate read authority from write authority. Organisations should also preserve action receipts showing what the agent changed, what permission it used and how they can reverse the action.
OWASP’s AI-agent security guidance likewise recommends minimum tool access, per-tool permission scoping and explicit authorisation for sensitive operations.
Testing AI agents before expanding access
Testing should focus on authority failures, not only output quality.
Before increasing an agent’s access, teams should test what happens when instructions conflict, source data contains misleading content, another agent asks for help, a tool returns unexpected information, or a supposedly routine task crosses a spending, safety or contractual threshold.
NIST’s earlier request for information on AI-agent security specifically highlighted the need to constrain and monitor the extent of agent access in deployment environments.
Serious near misses should trigger review even when a human stops the final action. Supply chain teams already investigate failures involving quality, safety, fraud and continuity. An agent that attempts an unauthorised transfer, changes supplier data outside policy, or delegates consequential authority unexpectedly should create the same kind of learning opportunity.
Independent red-teaming work has shown that information encountered during operations can manipulate AI agents, including through indirect prompt-injection attacks. That makes post-incident learning and permission redesign part of normal operations rather than an exceptional exercise.
Moving from AI experimentation to automation
I help organisations adopt AI, so my interest here is practical adoption rather than slowing it down.
Strong controls can make faster deployment easier because leaders know where autonomy ends. An authority ledger gives them a way to expand that autonomy deliberately.
Let agents act where consequences are bounded and reversible. Require fresh approval where money, supplier identity, contractual commitments, safety or critical operations are at stake. Only expand authority after evidence shows the system can handle it reliably.
That is a workable path from AI experimentation to durable automation: fast action where the risk is contained, explicit limits where the stakes rise, and a record operators can inspect when something goes wrong.
The views and opinions expressed in this article are those of the author and do not necessarily reflect the views of Supply Chain Channel.
Gleb Tsipursky Ph.D
Named the “Office Whisperer” by The New York Times, I help tech-forward leaders stop overpaying for AI while boosting engagement and innovation as the CEO of Disaster Avoidance Experts. My eighth book, due out with Georgetown University Press in Fall 2026, is The Psychology of AI Adoption at Work: From Resistance to Results. I published over 650 articles and gave over 550 interviews in venues such as Harvard Business Review, Fortune, Time, Forbes, and The New York Times.
