PAVREN: Governing the Right to Act

An institution may deploy an AI system that performs its assigned task accurately and still discover that an important action lacked legitimate authorization. The gap between competence and permission matters more as software moves from advice to execution. This paper sets out the institutional argument behind PAVREN: authority must be established by legitimate human and organizational processes, bounded when delegated, preserved through changes in systems and context, and verifiable at the moment consequential actions take effect. The argument covers autonomous agents and also AI-mediated decisions, data use and institutional oversight. It builds on established work in AI risk management, management systems, access control, rights and accountability, and concentrates on a question that work often treats as settled: whether the person or body that authorized an act was entitled to authorize it. The paper closes with the limits of the argument and a set of scenarios for testing whether the approach improves governance in practice.