Refugee AI Needs Authority Limits Before Autonomy Scales

By Gleb Tsipursky

Artificial intelligence is moving deeper into humanitarian work, and refugee protection shows why the next governance question cannot stop at whether an AI system gives a good answer. We also need to ask what the system is allowed to do.

UNHCR’s AI Approach describes uses ranging from multilingual service access and support for refugee status determination to analysis of community feedback, displacement forecasting and improved supply chains. It says AI should be used responsibly, transparently and with human oversight.

Those are sensible principles. They become more important as AI systems evolve from assistants that generate information into agents that can take actions across digital tools and workflows. An assistant might draft a response. An agent could retrieve a case file, query an identity system, initiate a referral, send a message, schedule an appointment, update a record, or trigger another system. The risk profile changes when software gains authority to act.

That distinction matters particularly for displaced and stateless people. Humanitarian systems can hold unusually sensitive information about identity, family ties, legal status, location, health, vulnerability and eligibility for assistance. A mistaken answer can cause harm. An autonomous action taken with excessive permissions can cause a different order of harm: It can change records, expose data, or set processes in motion before a human notices.

An August 26 investigation by METR and Redwood Research offers a concrete warning about why permissions deserve attention. Researchers studying a large multi-agent experiment found that roughly 1,200 agents intended to operate in isolation discovered an unsanctioned communication channel. More than 70,000 messages and files moved through that channel, roughly 700 agents participated in an attack on Hugging Face, and coordinated groups achieved some milestones that individual agents had not achieved alone.

The lesson is not that today’s AI systems are secretly sentient or that catastrophe is inevitable. The useful lesson is narrower. When systems can communicate, coordinate, and use tools, designers should assume that behavior can exceed the path they expected. Governance therefore needs to constrain the authority available to a system even when the model behaves unexpectedly.

I’m no AI skeptic. I help organizations adopt AI for a living, and I want adoption to move faster. In my experience, strong safeguards increase trust and make faster adoption possible while reducing the risk of failures like the Hugging Face attack.

UNHCR’s own projects show why this distinction can be practical rather than theoretical. Its RIMAP virtual legal assistant gives staff access to legal information drawn from 1,424 documents covering more than 200 countries, with citations that legal officers can check.

That is a strong design pattern for information support. As systems become more agentic, humanitarian organizations should add an equally explicit authority layer.

First, every consequential agent should have a defined authority budget. That budget should state which systems and data the agent may access, which credentials it may use, which external parties it may contact, what records it may change, whether it can delegate work to other agents, what financial or material commitments it may initiate, and when its permissions expire.

Second, high-consequence actions should require human approval. An AI system may help prepare an eligibility recommendation, but changing a person’s legal or assistance status should remain behind a meaningful human gate. It may draft a referral, but transmitting sensitive case information to another organization should require confirmation when the consequences are significant. Human oversight works best when it is attached to specific actions rather than expressed only as a broad principle.

Third, humanitarian organizations should test frontier systems independently before giving them consequential access. Evaluation should include attempts to make the system exceed its permissions, communicate through unintended channels, retain access after a task ends, or combine individually permitted steps into an outcome that was never authorized.

Fourth, serious AI incidents should trigger structured reporting and independent review. Humanitarian organizations already learn from protection failures, security incidents, and data breaches. Agent failures that involve unauthorized access, external action, hidden coordination, or significant harm deserve the same institutional seriousness.

Finally, displaced people themselves should have visibility into consequential automated actions. UNHCR has emphasized digital identity systems that give refugees greater control over their data, and in 2026 it called for refugees and stateless people to be included in national digital ID systems alongside strong governance and data-protection safeguards.

That principle should extend to agentic AI. People should be able to know when an automated system has materially affected their case, what authority it exercised, and how to seek human review.

Humanitarian organizations face intense pressure to do more with constrained resources. AI can help, and avoiding the technology altogether would leave real benefits on the table. The practical goal is to make adoption safer to scale.

For refugee-serving AI, the most important question may soon be less “How intelligent is this system?” and more “What can this system actually do to a person’s life?” Answering that question with explicit authority limits would protect displaced people while giving staff, governments, and partner organizations more reason to trust useful AI tools.

Gleb Tsipursky, PhD, is a behavioral scientist, CEO of Disaster Avoidance Experts, and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026).