Content filters effectively block unsafe AI output but cannot determine an agent's authorization for specific business actions. AI agents can perfectly follow instructions yet still perform unsanctioned tasks, leading to issues like excessive refunds or overlooked conditions. These problems arise not from AI reasoning failures but from a gap between technical capability and business authority. As AI moves from recommendation to action, production agents require explicit decision rights defining what they can execute, approve, recommend, or never touch. Guardrails are necessary but distinct from authority models, addressing different governance needs. Decision rights answer whether an agent is authorized for a safe and technically valid action, a question highlighted by recent surveys showing widespread AI agent incidents and hidden agents. Enterprises need an Agent Authority Contract detailing ownership, allowed actions, system access, materiality limits, triggers for escalation, reversibility, and expiration. This contract, along with access controls, determines whether an agent may take a specific action in context. Consequential agent actions should be categorized as Allow, Approve, Recommend, or Deny, with Deny enforced outside system prompts. Runtime decisions are crucial, evaluating agent identity, context, and impact before allowing, approving, recommending, or denying actions. The most dangerous AI mistake isn't an incorrect answer but a correct action taken without proper authorization. Human oversight should target exceptions, not every action, to avoid rubber-stamping and maintain attention. Proportional authorization, where low-risk actions run autonomously and high-risk ones require approval, offers a workable model. Success metrics for agents must extend beyond accuracy to include override rates, escalation precision, unauthorized attempt frequency, business impact error rates, and decision latency. The governance gap lies not in the AI model but in defining and enforcing delegated authority through an Agent Authority Contract.