When Permission Becomes Power

By John R. Kennedy · October 31, 2026

Why giving AI permission to help us may mean surrendering more control than we realize

Most of us give other people permission to make decisions on our behalf without thinking much about it. We authorize an accountant to prepare our taxes, allow employees to make purchases for our businesses, and trust family members to handle responsibilities when we're unavailable. These arrangements are so familiar that we rarely consider how much judgment is involved in carrying them out.

When I ask an employee to resolve a customer's problem, I'm not necessarily telling that employee exactly what to do. I'm describing an outcome and relying on their experience to determine how best to accomplish it. They might contact a vendor, replace a piece of equipment, or spend additional time investigating something that initially appeared straightforward. As long as their decisions remain within the boundaries of their responsibilities, I generally don't need to approve every step.

This arrangement works because the employee understands more than the words of my instruction. They have experience with our customers, some understanding of the business, and an awareness of the consequences that different decisions might produce. They also recognize that certain situations require additional approval, even when I haven't specifically mentioned them.

I've been thinking about how much of that understanding we take for granted as AI becomes capable of performing similar tasks.

For years, our interactions with computers have been relatively predictable. We tell a system to perform a particular operation, and it follows instructions established by the software's developers. Even when those operations are complicated, the boundaries of the system's behavior are generally defined in advance.

Artificial intelligence is changing that relationship because we're beginning to give systems objectives rather than detailed instructions. Instead of telling a computer exactly how to accomplish something, we can increasingly describe what we want and allow the technology to determine the steps necessary to achieve it.

That sounds like a natural progression in the development of useful technology, and in many respects it is. But I believe it introduces a distinction between permission and authority that deserves considerably more attention.

Imagine asking an AI assistant to organize your upcoming vacation. You give it access to your calendar, email, and travel preferences, expecting it to identify suitable flights, compare accommodations, and prepare an itinerary. The assistant might discover that the hotel you originally considered is unavailable and recommend another property nearby. It could recognize a scheduling conflict and suggest adjusting your departure time.

So far, the arrangement seems straightforward. You're benefiting from a system that can gather information, consider alternatives, and save you considerable effort.

But suppose the assistant discovers that a more convenient flight costs several hundred dollars more than the alternatives. Should it purchase the ticket because it believes the additional convenience justifies the expense? What if the less expensive flight requires changing an appointment on your calendar? Should it reschedule the appointment without asking?

Perhaps you've given the assistant permission to book travel and manage your calendar. Technically, it may have everything it needs to perform those actions.

Yet that doesn't necessarily mean you've authorized it to make every decision those permissions make possible.

The distinction becomes clearer when we consider how people handle similar situations. A travel agent might have your credit card information and permission to arrange a trip, but you'd probably expect to be consulted before an unexpectedly expensive purchase. An administrative assistant might manage your calendar while understanding that certain appointments shouldn't be moved without your approval.

Those expectations aren't always written down. They develop through relationships, experience, and a shared understanding of what constitutes reasonable judgment.

AI systems don't automatically possess that understanding simply because we've given them access to the necessary applications.

This is where I think our traditional approach to technology permissions begins to reveal its limitations.

Most software systems are designed around relatively straightforward questions of access. Can this person view a document? Can this application modify a record? Is this user permitted to approve a transaction?

These controls are essential because they help prevent unauthorized activity. But they were largely developed for environments where the person using the system was expected to supply the judgment behind an action.

If I give an employee permission to modify customer records, I'm assuming that the employee will use that capability in accordance with their responsibilities and the organization's expectations. The permission determines what they're technically allowed to do, while their judgment determines when doing it is appropriate.

When we give an AI assistant the same permission, we're introducing a system that may make both decisions.

It can determine what action to take and then use its access to carry out that action.

The technical permission hasn't necessarily changed, but its significance has.

Consider a small business that uses an AI assistant to help manage customer relationships. The assistant can access customer correspondence, update records, and send messages on behalf of employees. Its purpose is to reduce administrative work and ensure that customers receive timely responses.

One day, the assistant discovers an unanswered customer complaint. It examines the correspondence, determines that the customer has a legitimate concern, and sends an apology along with an offer to provide a discount on future services.

From the assistant's perspective, the action may seem entirely reasonable. It identified a problem, considered the available information, and attempted to preserve a valuable customer relationship.

But perhaps the complaint involved a contractual dispute that the business was already addressing through its attorney. Maybe the customer had misunderstood the circumstances, or the proposed discount would establish an expectation the company couldn't reasonably extend to other customers.

The assistant may have acted with good intentions and within its technical permissions while creating a problem that nobody authorized it to create.

I find this example interesting because the failure isn't necessarily a failure of intelligence. A capable human employee could make a similar mistake.

The difference is that organizations have developed ways of managing human judgment through supervision, training, experience, and accountability. Employees learn which decisions they can make independently and which situations require additional consideration.

Those boundaries are often more complicated than a list of permitted actions.

A new employee might be allowed to issue a modest refund but expected to consult a supervisor when a customer threatens legal action. A senior employee may have greater discretion because they've demonstrated an understanding of the organization's priorities and the consequences of their decisions.

We don't simply give everyone the same authority because they have access to the same information.

As AI becomes more capable, I suspect we'll need to develop similarly nuanced expectations for intelligent systems, particularly when they operate across several applications or organizations.

This brings me back to something I've discussed in earlier writings: the difference between possessing information and having the right to use it.

A business may have access to sensitive customer records because those records are necessary to provide a service. Employees may be authorized to examine that information when performing their responsibilities. But neither the existence of the records nor the ability to access them establishes unlimited authority to use the information for unrelated purposes.

An AI assistant introduces another layer because it may be able to combine information from multiple sources in ways that weren't anticipated when the original permissions were granted.

Imagine an assistant helping a company evaluate which customers might benefit from a new service. It examines purchasing history, support requests, and previous correspondence. The resulting analysis could be useful, allowing the business to identify opportunities to provide more relevant assistance.

But suppose the assistant also has access to financial records or confidential information collected for another purpose. It might discover relationships that appear helpful in predicting customer behavior, even though using that information for marketing was never part of the original understanding.

The assistant may not be violating a technical access restriction. It may simply be using information that was available to it.

Yet the fact that information can be accessed doesn't mean every possible use of that information is appropriate.

This distinction is particularly important because artificial intelligence is capable of recognizing relationships that people might never have considered. That's one of its greatest strengths, but it also means the consequences of granting access can become difficult to anticipate.

When we give a system permission to use information, we may be authorizing more than the specific actions we had in mind.

I've started thinking about how this changes the meaning of consent.

In ordinary life, consent generally depends upon some understanding of what we're agreeing to. We don't necessarily need to know every detail, but we expect the agreement to establish reasonable boundaries around what another person or organization can do.

When I authorize someone to repair my vehicle, I'm not automatically giving them permission to replace the engine because they believe it would improve performance. When I allow a contractor into my home, I'm not authorizing them to reorganize my possessions simply because they think the arrangement could be more efficient.

The permission is connected to a purpose, and the purpose helps define its limits.

Artificial intelligence makes this relationship more complicated because an agent may discover new ways to accomplish an objective that neither the user nor the developer anticipated.

Suppose I ask an assistant to reduce the operating expenses of my business. It might identify unused software subscriptions, compare service providers, and recommend changes that would produce meaningful savings.

Those are exactly the kinds of capabilities that could make AI extraordinarily valuable.

But what happens when the assistant discovers that terminating a particular service would save money while eliminating a capability that employees rarely use but depend upon during emergencies?

Or suppose it determines that reducing customer support hours would improve profitability, without recognizing the long-term importance of being available when customers need assistance.

The assistant might be optimizing for the objective I provided while overlooking values that I never thought to include in the instruction.

This is one reason I believe the quality of an AI system's judgment cannot be evaluated solely by whether it accomplishes the task it was given.

A system might successfully reduce expenses while damaging relationships, weakening security, or creating obligations that outweigh the savings.

The objective may have been achieved, but the outcome may not reflect what the person giving the instruction actually wanted.

People encounter similar problems when delegating responsibilities to one another, but our shared experiences provide a foundation for resolving them. We can explain expectations, discuss tradeoffs, and recognize when a decision conflicts with values that weren't explicitly stated.

AI systems may eventually become very good at recognizing these conflicts, but their ability to identify a possible consequence doesn't automatically establish the authority to decide which consequences are acceptable.

That decision may belong to the person or organization whose interests are affected.

I think this is where the distinction between intelligence and authority becomes especially important.

An AI assistant might understand a situation better than the person using it. It may recognize patterns, evaluate alternatives, and predict consequences with remarkable accuracy. In some circumstances, its recommendations could be considerably better than those produced by a human expert.

But being capable of making a good decision isn't the same as having the right to make it.

We recognize this distinction in many areas of society. A financial advisor may possess greater investment knowledge than a client, but that doesn't necessarily give the advisor unrestricted authority over the client's money. A physician may understand medical treatment far better than a patient, yet informed consent remains an essential part of the relationship.

Expertise can inform decisions without replacing the rights of the people affected by them.

I believe the same principle should guide our relationship with artificial intelligence.

As these systems become more capable, the temptation will be to give them increasingly broad authority because doing so makes them more convenient. An assistant that constantly asks for permission can become frustrating, particularly when it seems capable of making reasonable decisions independently.

But the alternative shouldn't be unrestricted autonomy.

We need to become better at distinguishing between decisions that can reasonably be delegated and those that require explicit human involvement.

The appropriate boundary will vary depending on the circumstances. An assistant might be permitted to reorganize files without asking, provided it doesn't delete important information. It could prepare customer correspondence for review while requiring approval before sending messages that establish financial or legal commitments.

In other situations, an AI system might be allowed to act independently within carefully defined limits, escalating decisions when the potential consequences exceed those boundaries.

These arrangements shouldn't depend entirely upon whether the technology is capable of performing the action. They should reflect the responsibilities, relationships, and values of the people and organizations involved.

I've also been thinking about what happens when an AI assistant delegates work to another intelligent system.

Imagine giving one assistant permission to organize a project. It discovers that another specialized agent can complete part of the work more efficiently and shares the necessary information so that agent can perform the task.

The original assistant may have been authorized to access the information, but does that authorization automatically extend to another system?

What if the second agent relies on a third service, or stores information in an environment governed by different rules?

The chain of activity may become increasingly difficult for the original user to understand, even though each individual step appears reasonable.

This isn't entirely unlike the relationships businesses already maintain with contractors and service providers. Organizations frequently rely on third parties to perform work, and those third parties may depend upon additional companies to deliver their services.

We've developed contracts, security requirements, and accountability mechanisms to manage those relationships, although their effectiveness varies considerably.

Artificial intelligence could make these arrangements more dynamic. Instead of relying on a relatively stable collection of vendors and employees, we may eventually have intelligent systems selecting and coordinating other systems in response to changing circumstances.

That creates enormous opportunities for efficiency, but it also raises questions about how permissions, obligations, and responsibility should travel through those relationships.

If an assistant has permission to use an asset for a particular purpose, I don't believe that permission should automatically become transferable authority to use the asset for anything that contributes to the assistant's objective.

The original purpose still matters, as do the rights and expectations of the people associated with the information.

This is where I see the Asset Value philosophy becoming particularly relevant.

When we recognize that information, relationships, knowledge, and other resources possess value, we also begin to recognize that decisions about their use can affect people in ways that aren't immediately visible.

A customer relationship might be damaged by an automated message that appears harmless when considered in isolation. An employee's reputation could be affected by an AI-generated evaluation that relies on incomplete historical information. A family's privacy might be compromised by an assistant sharing records with another service simply because doing so would make a task easier.

These consequences remind me that authority isn't merely a technical setting. It's a responsibility connected to the people and assets affected by a decision.

The more capable artificial intelligence becomes, the more important it will be to preserve that connection.

I don't believe we should respond by preventing AI from acting independently. Much of its potential value comes from reducing the need for people to supervise every routine activity, and there will be countless situations where intelligent systems can make appropriate decisions more quickly and consistently than we can.

But I do believe we need to reconsider what we're actually granting when we authorize an AI assistant to help us.

We may think we're giving it access to applications or permission to perform tasks, when we're also allowing it to interpret our intentions, weigh competing priorities, and make decisions that affect people beyond ourselves.

Those responsibilities deserve more consideration than a simple choice between allowing or denying access.

As artificial intelligence becomes more integrated into our lives, I suspect we'll discover that some of the most important decisions involve determining what an assistant should be allowed to decide without us.

We may become comfortable allowing AI to make increasingly sophisticated recommendations, coordinate complicated activities, and perform work that previously required substantial human effort. But there will still be circumstances where the person affected by a decision should retain the authority to make it, even when an intelligent system could reach a reasonable conclusion on its own.

The challenge won't necessarily be teaching AI how to make decisions. It will be developing a shared understanding of which decisions belong to whom.

When I think about the future of intelligent assistants, I'm less concerned about whether they'll become capable of doing almost anything we ask. I believe that capability will continue to expand.

What concerns me more is whether we'll recognize the difference between giving an assistant permission to help us and giving it authority to determine what matters.

Because once a system can decide how to use the permissions we've granted, those permissions become something more than access.

They become power.

Continue reading: Everything Is an Asset. We Just Haven't Learned to See It That Way.