FG-0406 Invocation Authority
Description
Define who can invoke which agents and for what purposes. Not every participant should be able to dispatch every agent, especially in multi-human teams. Invocation Authority establishes which roles can activate which agents, preventing unauthorized use of specialized or sensitive capabilities. This is the access control layer for agent dispatch.
Implementation
Map agent capabilities to authorization levels. Define who can invoke each agent (all team members, specific roles, authority-holder only). For sensitive agents (those with elevated access or destructive capabilities), require explicit authorization from the authority holder. Log all invocations for audit purposes.
Success Indicators
- Agents with sensitive capabilities are only invoked by authorized personnel
- Invocation logs provide a clear audit trail of who activated what
- The team understands invocation boundaries without friction
- Unauthorized invocation attempts are caught and logged
Failure Modes
- Over-restricting invocation: creating bottlenecks on the authority holder
- Under-restricting: anyone can invoke any agent including sensitive ones
- No logging: can't audit who invoked what after the fact
- Authority rules that don't match actual operational needs