---
title: "KYE™ Authority Discovery™ — find your authority sprawl · KYE Protocol™"
description: "KYE™ Authority Discovery™ is a free assessment that inventories who and what can take consequential actions across your organisation — employees, contractors, agents, copilots, RAG systems, vendors, workflows, APIs — and scores the sprawl. Authority sprawl is the hidden risk of the agentic enterprise."
url: https://kyeprotocol.com/authority-discovery/
lang: en
source: "KYE Protocol"
---

> KYE™ Authority Discovery™ is a free assessment that inventories who and what can take consequential actions across your organisation — employees, contractors, agents, copilots, RAG systems, vendors, workflows, APIs — and scores the sprawl. Authority sprawl is the hidden risk of the agentic enterprise.

# Authority sprawl is the hidden risk of the agentic enterprise

Your organisation now runs on a crowd of actors that can take consequential actions: employees, contractors, agents, copilots, [RAG (Retrieval-Augmented Generation)](https://kyeprotocol.com/mcp/) systems, vendors, workflows and external APIs. Almost nobody can answer the simple question — _who can do what, on whose behalf, under what conditions, across which jurisdictions?_

**KYE™ Authority Discovery™** is a free assessment that finds out. It inventories your actors and scores the sprawl, so you can see your exposure before an agent acts on authority no one remembers granting.

[Run the free assessment](https://kyeprotocol.com/poc/) [See runtime enforcement](https://kyeprotocol.com/open-access-authority/)

## Four scores in minutes

Authority Discovery™ turns a vague worry into four concrete numbers you can act on.

### Authority Sprawl Score™

How many actors can take consequential actions, relative to how many are governed.

### Delegation Risk Score™

Over-broad grants, expired authorities, and orphaned permissions with no named owner.

### Jurisdiction Exposure Score™

Actors acting across borders with no rail resolving which law applies.

[Evidence Gap Score™ Consequential actions taken with no Evidence Pack™ — not replay-provable to a regulator.](https://kyeprotocol.com/evidence-pack/)

## Why this is the question that matters

Access controls tell you who can log in. They do not tell you who holds the _authority to act_ — and in the agentic enterprise those are no longer the same thing.

- The EU AI Act, GDPR and NIST AI RMF each bind _who may act_, on whose behalf, with what oversight.
- Every ungoverned agent is an actor your auditor cannot account for and your regulator can ask about.
- Exactly one finding repeats in every estate: authority granted once, never revoked, exercised by software.

Boundary: Authority Discovery™ inventories and scores — it does not enforce. It is the door into runtime authority: it converts into [KYE™ Open Access Authority™](https://kyeprotocol.com/open-access-authority/) (which adjudicates each action) plus a governed pilot. It is part of the [KYE Protocol™](https://kyeprotocol.com/) platform.

## Where it leads

Start free; convert when you are ready to govern what you found.

### Free Assessment

The four scores + an Authority Atlas™ view + recommended controls, scored in your browser.

### Discovery Workshop™

The facilitated paid tier: a signed sprawl report, remediation path, and pilot scope across your real estate.

[Runtime authority Open Access Authority™ adjudicates each agent action — the moat the assessment converts into.](https://kyeprotocol.com/open-access-authority/)

[Run the free assessment](https://kyeprotocol.com/poc/)