A model can produce an excellent recommendation in seconds. An organization still needs to establish which evidence supported it, who had authority, which rule applied, what action followed and which result the relevant parties will recognize. The output is one object in a longer institutional chain.
The chain around a decision
CLAIM -> EVIDENCE -> AUTHORITY -> DECISION -> ACTION -> SETTLEMENTA claim states that something is true: an asset exists, a company owns it, a document is current or a payment was received. Evidence supports the claim through a registry, signed document, sensor, bank statement or another accepted source.
Authority determines who may assert or rely on the claim and who may act for an organization. Decision is the application of policy to the available claims. The same evidence can produce different decisions under different mandates, jurisdictions or risk limits.
An action changes a system: approving a transfer, releasing funds, filing a report or updating a register. Settlement makes the economic, accounting, operational or legal consequence final enough that the parties must recognize it.
Most AI products concentrate on claims and decisions. Institutions live with the whole chain. The difficult proof is not that a model emitted a string. It is that the right system, using admissible evidence and a valid mandate, caused an authorized event under the applicable rules.
Access is not delegated authority
Suppose an agent reviews a transaction, produces a sound recommendation and can call the relevant application. Its credential proves that the application recognizes the caller. It does not necessarily prove that the principal allowed the agent to perform this action, for this counterparty, at this value and time.
A token might permit an API call while the commercial mandate permits the agent only to prepare a request for human approval. The action should then stop even though authentication and analysis both succeeded. Access describes a technical capability. Delegated authority describes the boundary within which an organization agrees to be bound.
That boundary has to cover action type, assets and counterparties, value and time limits, evidence requirements, delegation, revocation and conditions that force review. If it remains in a policy document that the execution path cannot test, it is guidance rather than a control.
A refused financing payment provides a concrete design case for binding an attempted action to its mandate, evidence and outcome. The point here is narrower: a model’s ability to recommend or call a tool cannot define its own authority.
Provenance preserves a relationship, not its meaning
Identity and cryptographic provenance solve necessary problems. A digital signature can connect a key to a record. A content credential can preserve declared origin and modifications in a signed, tamper-evident structure. C2PA states the limit precisely: provenance alone cannot establish that content is true, accurate or factual.1
The same distinction applies to authority. The Model Context Protocol’s authorization specification uses OAuth roles, protected-resource metadata and resource-bound token requests for tool-using clients.2 Those mechanisms improve access control. They do not determine whether a company authorized an agent to bind it commercially.
A valid signature can preserve a false statement. A genuine employee can act outside their mandate. A lawful registry can be stale for the decision at hand. Cryptography protects relationships between records; institutions decide which relationships are sufficient for a particular consequence.
Acceptance is an operating arrangement
For an action to be recognized, the workflow must define which sources may assert which facts, who may rely on them, which policy version controls, where enforcement occurs and how mistakes are challenged. It must also allocate responsibility when evidence is wrong, authority is exceeded or systems disagree.
Software can record these elements, but software does not create the agreement. Contracts, operating procedures, liability allocation and legal rules determine who accepts the record and for what purpose. An auditor or regulator can rely on it only to the extent that the governing framework makes its issuers, contents and retention procedure admissible.
This is also why a large audit trail may be insufficient. Several applications can each preserve a locally correct event without producing an account that another legal entity accepts. The case for infrastructure beyond internal logs begins only at that boundary; many organizations can and should use the systems they already operate.
Machine intelligence can reduce the cost of generating claims and recommendations. It does not eliminate the need to decide whose evidence counts, who may act and when a consequence becomes final. Until those transitions are satisfied, an AI output remains advice. The institutional event occurs only when the accepted chain carries it into action and settlement.
Footnotes
-
C2PA Content Credentials Explainer, version 2.4, sections 2 and 7.2.2. Last reviewed 2 September 2026. ↩
-
Model Context Protocol Authorization specification, 2026-07-28 revision, authorization flow, scope selection, resource parameter, and error-handling sections. Last reviewed 2 September 2026. ↩