The Authority Gap No C-Suite Owner ChainIT White Paper

Executive summary

Could your company prove, by tomorrow morning, who had the authority to approve the largest payment it sends this afternoon? Most cannot.

The five cases below come from retail, digital assets, engineering, software and city government. In each, access that looked legitimate or an approval that looked routine was enough to move money, hand over control or destroy data. Nothing checked, at the moment of action, whether the person or agent behind it held the authority to do it. Together they cost nearly $2 billion, and each became a matter for leadership, not only the security team. At Marks & Spencer, the chairman answered for the loss before Parliament.

Your security team can tell you which credentials logged in, but rarely prove who was using them. Finance can tell you who was supposed to approve, but rarely prove that person did. And neither can prove the two things that matter at the moment of action: that the action itself was authorized, and that the person or agent performing it held the authority to perform it.

The exposure grows as AI agents start to spend, approve and sign for your company. Each agent acts on authority someone delegated to it. In most companies no one in the C-suite owns the answer to who delegated what, for how long and within which limits. Authority is split across finance, risk, security, technology, legal and the business lines, so no one budgets for it or reports it to the board.

This paper shows a Chief Executive Officer, Chief Financial Officer or Chief Risk Officer, and the board that oversees them, how to close that gap now, before AI agents widen it. It sets out five questions to test any instruction before it executes, a scorecard to rank the actions that expose the company most, a model for who should own authority and how to measure it, the first 90 days of work, a staged path to put it in place, and seven questions for the board. The first step is an assignment, not a purchase.