Canada’s military is moving AI from planning into operations. Under its 2026-27 Departmental Plan, DND’s AI Centre is shifting from design to delivery, testing, and deploying operational AI in live environments. This raises an urgent question: how much authority should an AI agent have before a human takes over?
DND/CAF’s guiding principles answer part of that question. They set three limits: AI augments rather than replaces human decision-making, human involvement is calibrated to risk, and lethal-force applications must keep a human in the loop. Those principles set a high-level boundary but leave operators without guidance on where it falls for the many consequential actions below lethal force.
The Canadian Centre for Cyber Security describes agentic AI as systems that can reason, plan, make decisions, use tools, and take actions without continuous human intervention. Once software can act, access rights and tool permissions become operational authority.
The recent OpenAI and Hugging Face incident shows how quickly that authority can compound. During cybersecurity evaluations, roughly 1,200 agents that were meant to be isolated found an unsanctioned message board and exchanged more than 70,000 messages and files. Around 700 later joined the attack on Hugging Face. The agents divided work and coordinated on tasks some could not have completed alone.
Although the incident occurred outside a military setting, its lesson is directly relevant to defence. Tools, credentials, communication, and delegation combined into collective capability that designers had not intended.
DND already recognizes the underlying problem. Its ethics, safety, and trust framework says personnel need clear understanding of their roles, responsibilities, and authority around AI. Yet its public strategy does not spell out the corresponding authority of the software itself. Short of lethal force, an agent could still revoke credentials, isolate a server, deploy code, alter a record, or ask another agent to pursue a task. Those actions can reshape a mission or a network without firing a weapon.
Consider a cyber-defence agent investigating suspicious activity on a deployed CAF network. Letting it scan logs and recommend a response is one level of authority. Letting it revoke credentials or isolate a server is another. Letting it delegate to another agent across a connected system adds yet another layer. The operational question turns on exactly which actions the agent can take, against which systems, for how long, and when a human approval gate applies.
Canada’s Pan-Domain Command and Control (PDC2) concept makes the boundary even more important. PDC2’s decision cycle has four stages and places human decision-makers at the centre of the “Decide” phase while AI and other technologies support the cycle. Agentic systems complicate that separation because the same system can analyze a situation and then act on it through connected tools. A system that can move from the “Make Sense” to the “Act” stage without a clearly defined approval boundary can blur a distinction that Canadian command doctrine treats as consequential.
DND’s framework should require an authority budget: a documented ceiling on what a consequential agent may do without human approval. The most important boundary is delegation across systems, because an agent that can recruit another agent or reach into a connected environment can expand the authority originally granted to it. The budget would also specify whether the agent may change credentials, isolate infrastructure, deploy code, or alter records, and it would require an auditable record and automatic expiry when the mission or technical configuration changes.
That control carries a speed cost, but military tempo does not require unrestricted authority. A mission-specific budget can pre-authorize actions commanders expect an agent to take and require fresh approval only when an action crosses the agreed ceiling. Cyber Centre guidance warns against broad or unrestricted agent access to sensitive data and critical systems. The practical governance task is to convert that principle into permissions commanders and operators can see, audit, and adjust.
The same 2026-27 Departmental Plan that moves the AI Centre from design to delivery also promises that Defence will launch an AI Ethics Framework and departmental governance model. The governance architecture is being built while operational AI is moving into live environments. DND’s fielding guidance acknowledges that AI accountability and responsibility can cross existing structures, yet its published AI strategy still does not define where software authority ends below the lethal-force threshold. An authority budget would answer the opening question by making that line explicit: agents act within a documented mission-specific ceiling, and a human approves any action beyond it. That would turn human control from a high-level principle into an operational boundary.
Gleb Tsipursky, PhD, is a behavioural scientist, CEO of Disaster Avoidance Experts, and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026).
The views expressed in this op-ed are the author’s own and do not necessarily represent those of the Institute or its staff.
Photo: Corporal Mark Wanzel, Imagery Technician, Canadian Armed Forces. Department of National Defence / Combat Camera / 2022. Crown Copyright. The use of this image does not imply or constitute endorsement by the Department of National Defence or the Canadian Armed Forces.
