Where should execution authority live in an agentic system?

One of the assumptions behind CROA is that an AI agent should be able to propose actions, but should not be the final authority deciding whether those actions are allowed to change the state of a real system.

That sounds straightforward until you start looking at trajectories rather than individual actions.

Imagine an agent is allowed to expose up to 100 customer records. It performs three operations:

• expose 40 records

• expose another 40

• expose another 40

Each individual operation is within the 100-record limit. The resulting trajectory is not.

This is one of the problems that led us to CROA: evaluating not only whether an action is permitted, but whether the resulting execution state remains reachable under the registered constraints.

Our approach is to keep execution authority outside the agent and enforce those constraints before state change.

I'm curious how others working on agentic systems are approaching this.

Where do you think execution authority should live?

And more importantly: what breaks when the agent, the policy decision and the execution boundary are separated this way?

The CROA Pilot is public if you want to test the implementation rather than just discuss the idea.