Your AI agent passed every eval. Who authorized its next action?

We've spent a lot of time making AI agents smarter. I'm increasingly convinced we're asking the wrong question.

The hard problem isn't whether an agent can decide what to do.

It's whether anyone can independently verify that it was authorized to do it.

Consider a financial AI agent that initiates a transaction, changes a risk limit, or accesses sensitive customer data.

Six months later, an auditor asks:

• Who authorized that specific action?
• Which policy version was evaluated?
• What evidence supported the decision?
• Can we verify that the executed action matches what was approved?

A successful eval doesn't answer those questions. Neither does a beautiful observability dashboard.

At FoundLab, we're building REX Guard around a specific architectural principle:

AI proposes. Deterministic policy controls authorization. Execution produces verifiable evidence.

The goal is to make authorization enforceable at runtime, independent of the model, and bind the resulting action to an auditable decision record.

This introduces real engineering trade-offs: latency, failure handling, cryptographic evidence, privacy, and the separation of decision authority from execution.

I'm curious how other builders are solving this.

Where do you enforce authorization for AI agents with real-world side effects: inside the agent framework, at the tool gateway, or in the downstream system?

And how do you prove that the action actually executed was the one authorized?

— Alex Bolson
Founder & Chief Architect, FoundLab