Vendors govern their products
Model providers govern model access and behavior. Agent platforms orchestrate tasks. Identity providers establish identities and credentials. Tool providers expose operations and enforce permissions. These controls are necessary, but each provider sees only part of the enterprise context behind an action.
A vendor cannot infer complete business purpose, ownership, delegation, approval, or scope merely because its product can execute a request. Platform policy can establish what the provider allows; it cannot independently establish what each customer organization has authorized.
The enterprise defines mandate
Authority begins with the organization: its accountable people, policies, ownership, approved objectives, delegations, boundaries, and evidence. Those sources should remain relevant as work moves between models, agents, sessions, tools, and systems.
This is not an argument against vendors. It is a clear allocation of responsibility. Providers supply capability and their own controls. The enterprise determines legitimate use and should be able to carry that mandate across a changing technology stack.
An independent, portable authority layer
A durable authority model should not be reinvented when the enterprise adds a new model or agent framework. Enterprise-owned mandate can remain stable while integrations adapt to consequential control points in each system.
Independence also makes limits visible. Unsupported action paths, stale evidence, and conflicting authority should appear as gaps or exceptions, not be silently converted into approval. Enterprise authority should remain with the enterprise.
NEXT STEP