GRCLibrary.ai

Principle

Capability Is Not Authority Principle

This document states, in citable adopter-facing form, a foundational access-governance principle: capability is not authority. The technical ability to perform an action never, on its own, constitutes authorization to perform it. The principle names the recurring failure it forecloses, treating the existence of a means as permission to use it, and points at the corpus controls that already instantiate it. It is the access-governance counterpart to the library's principle-integrity-and-trustworthiness: where that principle governs the integrity of the work product, this one governs when an actor, human or automated, is permitted to act.

Type
Principle
Version
0.0.3
Date
2026-08-30
Owner
Governance Library Maintainer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Core Governance
Review frequency
Annual and upon material governance, AI, or regulatory change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Scope
  • 1. The principle
  • 2. The seven capability vectors
  • 3. What creates authority: the authorization grant
  • 4. Instantiation in the corpus
  • 5. Adoption guidance
  • Framework alignment

Frameworks it maps to

Related documents