When two AI agents are both authorised, who decides?

Most of the conversation about governing AI agents asks one question: is this agent authorised? As enterprises move from single agents to systems of agents, a harder one arrives. What happens when several legitimately authorised agents collide?

A collision with no bad actor

A procurement agent is authorised to place an urgent supplier order. A finance agent is authorised to reduce discretionary spending. An inventory agent has already decided more stock is needed. Finance freezes the relevant cost centre, and seconds later procurement submits the order.

Every agent may have behaved correctly. Every identity may have been valid, and every action may have sat inside that agent's permissions. The organisation can still end up with the wrong outcome.

Single-agent governance is the easier problem

Today's agent infrastructure mostly starts with the individual agent: give it an identity, define its tools, limit its permissions, monitor its behaviour and record what it does. Those controls are necessary.

But enterprise workflows rarely belong to one system. Procurement meets finance, sales meets legal, infrastructure meets security, customer operations meets billing. Agents working in those functions will meet each other, and independently correct decisions can become collectively wrong.

Authorisation does not resolve coordination

A customer-service agent is authorised to issue a refund. A fraud agent is authorised to freeze suspicious transactions. Both receive new information at about the same moment: the service agent starts the refund, and the fraud agent freezes the account.

Which state should win? "Both were authorised" is not an answer. Authorisation tells us whether each agent had legitimate power to act. It does not tell us how competing legitimate actions should be resolved. That needs another layer: priority, shared state, business policy, timing, dependency, and sometimes human judgement.

Agents may see different versions of reality

Agents may not even share the same state. One agent sees a budget of ₹10 lakh while another system has committed ₹4 lakh that has not yet propagated. One sees a supplier as approved while another has just received a compliance signal that should suspend it. One believes a customer account is active while another workflow is closing it.

None of these agents needs to be compromised. They may simply be acting on different snapshots of organisational reality, which turns state freshness into a governance problem.

Authority itself can conflict

Agents can also act for different principals. A procurement agent acts for an operations manager, a finance agent for the finance leadership, a security agent under an enterprise risk policy. Now all three touch the same transaction.

Which authority takes precedence? Can one agent suspend another's operation? Can an enterprise-wide policy override a department's delegation? Can a workflow be stopped once execution has begun, and who defines those relationships? These are not permission questions. They are questions about how authority composes.

Rules between agents

As agent systems grow, organisations may need explicit policies for how agents interact:

• Priority. Some authority supersedes other authority; a security containment policy may override a routine business operation.
• Reservations. Before an agent commits a scarce resource, the system reserves it so another agent cannot make an incompatible decision.
• Versioned state. An action records the state it was decided on; if that state changes before execution, the action is evaluated again.
• Conflict detection. Two individually valid actions can produce an invalid combined outcome, and the system has to see that before both are irreversible.
• Compensation. Some conflicts only appear after execution, so the system must know whether an action can be reversed, compensated or escalated.
• Human escalation. Some conflicts no policy can safely settle. Autonomy needs an exit.

Evidence has to cover the relationship

Suppose an unwanted purchase happens. A traditional audit trail shows that agent A placed the order, had permission, and the call succeeded. All true, and not enough.

A useful reconstruction also needs the state agent A observed, the authority it acted under, what agent B had already changed and whether A knew, which policy decided precedence, whether a conflict was detected, why the workflow continued, and the outcome that was finally produced. The unit of evidence moves from a single call to the relationship between decisions across a workflow.

An organisational problem, at machine speed

Companies already live with conflicting legitimate authority. Sales wants to close a deal, legal wants different terms, finance limits exposure, security restricts access. Escalation paths exist because no organisation works when every department holds independent authority with no way to settle disagreement.

AI agents inherit the same problem, except they may act faster, continuously, across more systems, and without noticing that another autonomous actor has changed the context their decision relied on.

The next control problem may be between agents

We have spent a lot of time asking who an agent is, what it can access, who authorised it and what it is doing. Those questions stay foundational. As agent populations grow, organisations will also need to understand the system the agents create together: agent and authority, but also agent and agent, authority and authority, action and action.

The hard case may not be a rogue agent breaking the rules. It may be two legitimate agents following theirs, and producing an outcome nobody intended.

Delegrity checks one agent's authority at the moment it acts. Coordinating authority between agents is a problem we are studying, not one we have solved. Delegrity is at design-partner stage, with no production customer evidence and no independent certification yet. Related: mandates, not permissions and what the 2026 data says.