One human approval. N spawned workers. The authority you granted doesn't stay where you granted it — it fans out.
Authority Fan-out (n.) — the risk class created when one human approval covers N spawned workers. An operator approves a task on one agent; the agent delegates — subagents, background tasks, scheduled runs — and each worker inherits real authority over files, credentials, and configs. The delegation happens after the approval moment, and the operator's mental model stays “one agent.”
You approve one task in your coding agent. The agent fans the work out — parallel subagents, a background task, sometimes a scheduled run that fires after you've walked away. Anthropic's 2026 Agentic Coding Trends Report: roughly 20 autonomous actions between check-ins. That's the productivity the whole field is chasing this year, and none of it is a bug.
The permission model that most tooling — and most operators — still assume is: one operator, one agent, one approval per consequential action. Orchestration broke that quietly. The approval is granted at the top of the chain; the execution happens layers down, under workers that didn't exist when you clicked approve.
Ask three questions of any fan-out: who is actually doing the work, what can each worker reach, and which of them would you have approved individually? If you can't answer from what's on your screen, you're carrying Authority Fan-out.
One human approval, N spawned workers — in a gated harness, the gate is the one thing in the chain that doesn't dilute.
Instructions dilute as they pass down a delegation chain — each hop is a retelling. A deterministic gate at the harness's action boundary doesn't sit in that chain: in a gated harness, an action meets the same gate whichever worker issues it, at the moment it would touch the machine. The gate reads the action, not the argument.
Deterministic enforcement of the precomputed-dangerous set where the harness supports a hook; defense-in-depth everywhere else. It does not take all risk away. — See how the runtime authority works →
Fan-out is an old, precise word. In circuits, it's how many inputs one output can drive. In distributed systems, it's one message reaching many receivers. In AI search, query fan-out is one question expanding into many. Authority Fan-out names what happens when the thing fanning out is your approval.
Dryx coined the term in July 2026. Use it — with or without us. A risk class you can name is one you can reason about, budget for, and ask your tools to account for.
The risk class created when one human approval covers N spawned workers. An operator approves a task on one agent; the agent delegates the work — subagents, background tasks, scheduled runs — and each worker inherits real authority over files, credentials, and configs. The delegation happens after the approval moment, so the operator's mental model stays “one agent” while the authority has already fanned out.
No — it's a risk class, not an attack. Nothing has to go wrong for it to exist, and delegation itself is what makes agents productive. It's the widened surface an attack would land on: N workers holding inherited authority instead of one. Prompt injection, a compromised MCP server, or a poisoned instruction file lands very differently when the approval already covers a fleet.
Three things. See it — watch a real session fan out in your harness's session view and count the workers your one approval covered. Gate it — put something deterministic at the harness's action boundary: in a gated harness, an action meets the same gate whichever worker issues it. Account for it — treat standing delegation surfaces like scheduled tasks and background workers as part of your exposure, not scaffolding. Deterministic enforcement of the precomputed-dangerous set where the harness supports a hook; defense-in-depth everywhere else.
Dryx inspects the AI agents you already run and draws the reach — secrets free, the full seven-surface map on Pro. On Pro with the direct-download build, your agent also gets deterministic enforcement of the precomputed-dangerous set where its harness supports the hook — defense-in-depth everywhere else.
Get early access → How the gate works →