Chain Authorization Gap

The Chain Authorization Gap is the absence of any authorization record for the outcome of a multi-agent chain, where no single agent in the chain was individually authorized for what the chain collectively did.

It is distinct from three related concepts. The Intent Gap describes behavioral drift in a single agent: the distance between what the agent was authorized to do and what it did in production. Agent Sprawl describes a deployment volume problem: more agents running than the organization knows about. The Chain Authorization Gap describes something different from both. It is a structural gap in the authorization architecture itself. The chain acted. No authorization record covers what the chain did.

Microsoft Entra Agent ID provides agent identities as special service principals and supports agent identity blueprints with linked child agent identities created from them. Copilot Studio separately supports connected-agent orchestration in which a primary agent delegates work to another agent. User tokens can carry the agent identity as the actor on behalf of the user as the subject. The A2A protocol supports shared identity, managed identity, and OAuth passthrough for agent-to-agent calls. Microsoft Purview audit and eDiscovery cover agent activity logs. These controls are real and they matter. They do not produce a single immutable record linking every delegation hop, approval, token scope, and final external effect to the human who authorized the chain to operate. That organizational governance layer sits above the platform. No platform currently builds it automatically. NIST opened a standards initiative in February 2026 specifically to address this gap. No finalized standard has been published.

What first-party Microsoft documentation does not specify, confirmed from primary sources reviewed in May 2026: a single immutable record linking every delegation hop, approval, token scope, and final external effect in a multi-agent chain. Purview captures activity. Entra Agent ID captures identity. Neither produces the chain-level authorization record that answers the four examiner questions: who asked, who authorized, which agent acted at each delegation hop, and what external effects the chain is authorized to produce.

The backbone of that record can be assembled from platform telemetry, joining Purview audit events, the Entra agent object with its linked child identities, and A2A call traces against the case identifier.

What telemetry cannot supply is the Authorization Root: the approving human, the approved scope, and the consent artifact exist only if the organization wrote them down first.

That gap is not a criticism of Microsoft's architecture. It reflects where the organizational accountability layer sits. Microsoft provides the substrate. The enterprise builds the authorization record above it. No enterprise should deploy a multi-agent orchestration and assume the platform has produced that record automatically.

Take one piece of paper. Name every multi-agent orchestration running in your environment. Next to each one, fill the review column: the date its individual agents last cleared identity and sponsor review. Then fill the approval column: the date each orchestration was approved as a unit, by name, by a person, in writing.

The review column fills itself. Platform controls like Microsoft Entra Agent ID keep individual agent identities sponsored, reviewed, and current, and sponsor lifecycle workflows now automate what happens when a sponsor leaves.

The approval column has no platform behind it. It only fills when a person writes something down. That asymmetry is why review meetings end with a full review column, an empty approval column, and a clean audit result that proves nothing about the chain.

The Examiner Test above checks one chain in depth: whether a single record answers the four questions. The Chain Authorization Test checks breadth: how many of your chains carry any unit-level approval at all, and how stale those approvals are against material changes. Run the breadth test first. It tells you which chain deserves the depth test next.