Explicit grants assigned to the agent.
AUTHORITY LEDGER
What authority does an agent actually possess?
Individual permissions do not show the effective authority created when direct grants, delegated scope, credentials, tools, and transitive reach combine.
From permission fragments to an effective authority surface
Bounded authority inherited from a parent.
Rights reachable through permitted credentials and tools.
Downstream reach created by composition.
A qualitative, tenant-scoped exposure map—not a fabricated score.
Why IAM snapshots miss it
IAM can accurately list a permission while missing the combined authority to read data, change deployment, and affect financial or operational resources through connected tools.
Example scenario: a workflow agent accumulates finance, deployment, and data authority through individually valid paths.
Reachable consequence
BOTKILER records authority sources, scope constraints, reachable resources, and the decisions that bounded the surface.
Trace the composed paths in Capability Graph →Evidence that remains
Authority-source provenance, tenant scope, delegated lineage, decision reason codes, and bounded reachability remain available for review.
View the platform architecture