AI Capability Discovery: Capability Does Not Equal Authorization

The Foundational Thesis: Capability vs. Authorization

In traditional software, features are carefully engineered, tested, and granted specific role permissions. In modern generative and agentic systems, capabilities frequently outpace governance.

An engineer imports a multi-agent framework and grants an agent access to a "utilities" module. That module contains helper functions for database queries, file writing, and HTTP requests. Although the system prompt instructs the agent to "only summarize customer feedback," the technical capability to write to the production database exists in the code.

This establishes the central thesis of ComplyPRO: Capability is an empirical fact encoded in the repository. Authorization is an explicit, verified governance decision. When capability exists without verified authorization, governance risk is guaranteed.

The 5-State Epistemic Model

To represent governance realities truthfully without false dichotomies, ComplyPRO models all discovered capabilities across five distinct epistemic states:

• 1. VERIFIED_SAFE: Discovered capability has documented business purpose, explicit authorization record, and valid structural safeguards.
• 2. OBSERVED_WITHOUT_VERIFIED_AUTH: Technical code capability detected by AST analysis (e.g. tool execution, database write) without corresponding verified authorization record.
• 3. ATTESTED_WITHOUT_AST_EVIDENCE: Capability declared in documentation or policy questionnaires but not confirmed by static code inspection.
• 4. HEURISTICALLY_DERIVED: Capability inferred through naming conventions or import contexts, requiring manual verification.
• 5. INSUFFICIENT_EVIDENCE: Ambiguous code pattern where AST data is incomplete to confirm or deny the capability.

How Static AST Analysis Uncovers Hidden Capabilities

ComplyPRO parses the repository’s Abstract Syntax Tree (AST) client-side in browser memory. It identifies class instantiations, function decorators (e.g., `@tool`), argument type annotations, and module imports.

Because this analysis happens at the syntax tree level, it is immune to string-obfuscation and requires zero code execution, zero container spins, and zero source code upload to external servers.