---
title: "Blanket authority: definition | KYA glossary"
url: https://knowyouragent.ch/en/knowledge/glossary/blanket-authority
lang: en
updated: 2026-10-12
license: © Innopulse Consulting GmbH
---

# Blanket authority

A blanket authority is a mandate without a defined scope that allows an agent any action and therefore cannot be meaningfully verified.

Whether an action lies within a blanket authority is trivially true and therefore meaningless. In the verification model the scope is then unknown, and the result does not get past level A1. Precise mandates name action types, amount limits and counterparties.

## Example

An agent gets access to the company credit card without a limit and without an expiry date. If it accidentally orders ten times the amount, it can neither be prevented nor proven that this was not intended.

## How it differs

Blanket authority is the opposite of least privilege. An [agent mandate](https://knowyouragent.ch/en/knowledge/glossary/agent-mandate), by contrast, sets action types, limits, counterparties and validity. A shared API key often works like blanket authority too, because it has no limits of its own.

## In practice

- Replace shared API keys and cards without limits with mandates per agent and task, each with its own limit and expiry date.
- Inventory your agents' existing access and flag everything without an amount limit or expiry; those are your blanket authorities.
- Keep wide authority where it is needed, deliberately and documented, and add escalation to a person above a threshold.

## Role in KYA

KYA cannot tell blanket authority from an intended wide authority, but it makes the scope visible: the certificate shows which limits the mandate contains and whether the action stayed within them.

Related check: [Scope of the action](https://knowyouragent.ch/en/method/checks) (`intent_scope`). Is the action within the mandate's action type, amount limit, currency and counterparty?

[Verify now: open a matching example](https://knowyouragent.ch/en/verify?beispiel=abgelehnt)

## Frequently asked questions

### What is blanket authority for AI agents?

Access without effective limits, such as an API key or a card without a limit, that lets an agent do almost anything.

### Why is blanket authority dangerous?

Because mistakes or manipulation of the agent take full effect and it cannot be shown later what was allowed.

### How do you replace blanket authority?

With a mandate per task that has amount limits, permitted counterparties, short validity and the option of revocation.

### How do I recognize blanket authority?

By missing limits: no amount limit, no restriction of counterparties, no expiry date or no option to revoke.

### Is every API key blanket authority?

Not necessarily, but often. A key without limits of its own gives an agent all rights of the account it is tied to.

### Can existing blanket authority be replaced step by step?

Yes. Start with the actions that could cause the most damage, such as payments, and replace blanket access there with mandates that have limits. Further areas follow until no unlimited access remains.

## Sources

- [NIST: Least Privilege](https://csrc.nist.gov/glossary/term/least_privilege)
- [KYA verification profile](https://knowyouragent.ch/en/standard/verification-profile)

## Related terms

- [Agent mandate](https://knowyouragent.ch/en/knowledge/glossary/agent-mandate)
- [Fail-closed](https://knowyouragent.ch/en/knowledge/glossary/fail-closed)

---
Quelle: https://knowyouragent.ch/en/knowledge/glossary/blanket-authority · KYA – Know Your Agent