Authority sprawl is the hidden risk of the agentic enterprise

Your organisation now runs on a crowd of actors that can take consequential actions: employees, contractors, agents, copilots, RAG (Retrieval-Augmented Generation) systems, vendors, workflows and external APIs. Almost nobody can answer the simple question — who can do what, on whose behalf, under what conditions, across which jurisdictions?

KYE™ Authority Discovery™, step by step

Demo data

You learn: What happens at each step. You can: Step through it.

  1. Step 1 of 4

    KYE Protocol™

    Authority Sprawl Score™

    How many actors can take consequential actions, relative to how many are governed.

  2. Step 2 of 4

    KYE Protocol™

    Delegation Risk Score™

    Over-broad grants, expired authorities, and orphaned permissions with no named owner.

  3. Step 3 of 4

    KYE Protocol™

    Jurisdiction Exposure Score™

    Actors acting across borders with no rail resolving which law applies.

  4. Step 4 of 4

    KYE Protocol™

    Evidence Gap Score™

    Consequential actions taken with no Evidence Pack™ — not replay-provable to a regulator.

How this widget is built
Demonstrates
KYE Protocol™
Components
  • The steps this page describes
Flow
Each step in order, as the page sets it out. Architecture diagram
Used on

KYE™ Authority Discovery™ is a free assessment that finds out. It inventories your actors and scores the sprawl, so you can see your exposure before an agent acts on authority no one remembers granting.

Run the free assessment See runtime enforcement

Four scores in minutes

Authority Discovery™ turns a vague worry into four concrete numbers you can act on.

Authority Sprawl Score™

How many actors can take consequential actions, relative to how many are governed.

Delegation Risk Score™

Over-broad grants, expired authorities, and orphaned permissions with no named owner.

Jurisdiction Exposure Score™

Actors acting across borders with no rail resolving which law applies.

Evidence Gap Score™

Consequential actions taken with no Evidence Pack™ — not replay-provable to a regulator.

Why this is the question that matters

Access controls tell you who can log in. They do not tell you who holds the authority to act — and in the agentic enterprise those are no longer the same thing.

  • The EU AI Act, GDPR and NIST AI RMF each bind who may act, on whose behalf, with what oversight.
  • Every ungoverned agent is an actor your auditor cannot account for and your regulator can ask about.
  • Exactly one finding repeats in every estate: authority granted once, never revoked, exercised by software.

Boundary: Authority Discovery™ inventories and scores — it does not enforce. It is the door into runtime authority: it converts into KYE™ Open Access Authority™ (which adjudicates each action) plus a governed pilot. It is part of the KYE Protocol™ platform.

Where it leads

Start free; convert when you are ready to govern what you found.

Free Assessment

The four scores + an Authority Atlas™ view + recommended controls, scored in your browser.

Discovery Workshop™

The facilitated paid tier: a signed sprawl report, remediation path, and pilot scope across your real estate.

Runtime authority

Open Access Authority™ adjudicates each agent action — the moat the assessment converts into.

Run the free assessment