The decision-right question
An agent can draft for a person to send without carrying the same consequence as an agent that sends, pays, deletes, or otherwise crosses a one-way door. Once the action can create a commitment, the operating question changes: whose authority is being borrowed, what is the permission ceiling, and who can interrupt it?
What the public record shows—and does not show
IMDA’s Model AI Governance Framework for Agentic AI v1.5 is voluntary guidance. It recommends scoped, least-privilege, non-transferable authority; recorded delegations; permissions no broader than the authorizing human’s; and explicit escalation for high-stakes or irreversible actions. It is not law, a universal control standard, evidence that a particular authorization is valid, or proof of control effectiveness.
Berkshire Hathaway’s 1979 and 1999 shareholder letters provide a bounded historical delegation contrast. The 1979 letter described financial decisions as centralized at the top while operating authority was delegated to managers at individual companies or business units. The 1999 letter said managers were truly in charge, with no budgets approved by headquarters and no headquarters dictums about capital expenditures. The 1979 letter also supplied its own counterweight: closer operating controls might have minimized an occasional major mistake.
These historical company records make a reserved-versus-delegated distinction visible. They cannot support: Current Berkshire policy or condition; the motive, competence, integrity, or legal authority of any person; universal effectiveness of decentralization; control adequacy; a specific outcome; an AI-agent governance model; or a prescription for another organization.
Toyota’s official history supplies a different, bounded comparator: at Kamigo Plant in 1966, andon boards and lights could signal a problem so a supervisor could come to the source and address it. That record is not an AI-governance model, safety proof, universal operating rule, or conclusion about another organization’s controls. It makes one question visible: does an exception have a route to a responsible human who can interrupt it?
The diagnostic: The Pen Ledger
For one bounded agent action, record six fields:
Authority lender — whose direct authority does the agent borrow?
Permission ceiling — what is the highest action it may take without another decision?
One-way door — where does the action become difficult to reverse?
Approving owner — who can decide whether that threshold may be crossed?
Override evidence — what records a human interruption, narrowing, or return to a reversible path?
Successor — who inherits the delegation context when the role or workflow changes?
How to read the result
Use the Pen Ledger when a workflow crosses a one-way door. If the lender, ceiling, intervention route, and successor can be named, the delegation can be challenged and changed. If one cannot, that missing line is the next commitment to settle. The Ledger does not determine legal authority or control adequacy.
Start with a routine path nearest to sending, paying, deleting, or another one-way door. Add its human owner and override record. The aim is not to declare the delegation valid. It is to make the next decision right visible before the consequence grows.