Who Actually Has Authority When an AI Agent Crosses Multiple Systems?

Most discussions about AI agent permissions focus on the agent itself. But once an agent starts operating across multiple systems, authority becomes much harder to reason about. Imagine one transaction moving through: an identity provider a CRM an internal API a third-party model a payment or transaction system an approval workflow Each component may have its own permissions and controls. But who is responsible for the authority of the full chain? A few questions become difficult very quickly: Does authority established in one system carry into the next? Can one system safely rely on context or approval from another? What happens when permissions change halfway through the workflow? Which policy wins if two systems apply different rules? Can the final action be traced back to the authority that justified it? Who should stop the transaction if the combined sequence becomes higher-risk than any individual step? This makes me wonder whether agent governance needs to move beyond identity and access control at the component level. The real unit of governance may increasingly be the transaction chain. An agent might be authorised to perform every individual step while the combined sequence should still be blocked. How are people thinking about authority across multi-system agent workflows?