
685 A.2d 435 (1996)
344 Md. 85
ARA HEALTH SERVICES, INC., d/b/a Correctional Medical Systems,
v.
DEPARTMENT OF PUBLIC SAFETY AND CORRECTIONAL SERVICES.
No. 138, September Term, 1995.
Court of Appeals of Maryland.
November 26, 1996.
*436 Philip M. Andrews (Kevin F. Arthur, Kramon & Graham, P.A., on brief), Baltimore, for Petitioner.
Kathleen Hoke Dachille, Assistant Attorney General (J. Joseph Curran, Jr., Attorney General; Evelyn O. Cannon and Michael O. Doyle, Assistant Attorneys General, on brief), Baltimore, for Respondent.
Argued before MURPHY,C.J.,[*] and ELDRIDGE, RODOWSKY, CHASANOW, KARWACKI, BELL and RAKER, JJ.
PER CURIAM.
This case involves a contract dispute between the State, acting through the Department of Public Safety and Correctional Services (the Department), and ARA Health Services Inc., d/b/a Correctional Medical Systems (CMS). The question presented is whether CMS's claim for additional compensation under a health services contract with the Department is barred by the doctrine of sovereign immunity. CMS contends that the waiver of immunity codified at Maryland Code (1984, 1995 Repl.Vol.), State Government Article, § 12-201(a)[1] prevents the Department from asserting immunity as a defense to this claim. We conclude, however, that CMS's claim does not satisfy the requirements of § 12-201(a) and that the Department is immune from liability.

I.
The specific dispute between the parties is whether CMS is entitled to reimbursement for AIDS medication provided to non-hospitalized prison inmates during the initial 18-month term of its contract with the Department. The facts giving rise to this claim for additional compensation are essentially undisputed.
In September 1988, the Division of Correction (DOC) of the Department of Public Safety and Correctional Services solicited bids from contractors for the provision of medical services to State prison inmates. CMS responded to the solicitation and was subsequently awarded the health services contract at issue in this case. Prior to execution, State procurement law requires review and approval of this type of procurement contract by the Board of Public Works. See Code of Maryland Regulations (COMAR) 21.02.01.05A(1).
The initial term of the contract was from January 1, 1989 to June 30,1990. The DOC was contractually required to remit monthly payments to CMS for four categories of expenses: (1) primary care services; (2) secondary care services; (3) operating costs; and (4) a management fee. The category relevant to this case is secondary care services, which included hospital services and specialty services, such as radiological, obstetric, and dental procedures. Secondary care services also included "[t]he cost for the medication AZT, also known as Retrovir, and the cost for any newly developed medication for AIDS/ARC patients...." The monthly payment for these services was not based on actual cost, but rather was calculated on a fixed rate per capita basis. The amount of compensation due CMS each month for AIDS medication and other secondary care *437 services, therefore, was fixed by the contract terms.
Notwithstanding the cap on secondary care services, however, CMS was entitled to additional compensation for "the price of eligible AIDS related ... hospital services costs," provided that certain conditions were satisfied; namely, CMS must have expended more on secondary care services than was due under the monthly fixed fee. If this overexpenditure requirement were satisfied, CMS would be entitled to reimbursement for either the actual cost of AIDS related hospital services, or the difference between the secondary care services fixed fee and the actual cost of providing secondary care services, whichever was less. The effect of this provision was that CMS was eligible to receive additional compensation for AIDS medication provided to inmates during hospitalization.
In sum, the express terms of the contract indicated that CMS was not entitled to compensation on a dollar-for-dollar basis for AIDS medication administered to inmates at correctional facilities. However, CMS would receive reimbursement, in the appropriate circumstance, for the actual cost of AIDS medication furnished to inmates at hospitals, in that medication dispensed at hospitals is a "hospital services cost." Despite the different treatment of hospitalized and non-hospitalized inmates prescribed by the contract, CMS submitted invoices to the DOC for the actual cost of AIDS medication provided to inmates at correctional facilities. In contravention to the express terms of the contract and without Board of Public Works approval, the DOC paid these invoices, and from January 1, 1989 to June 30, 1990, reimbursed CMS a total of $135,446.00 for the cost of non-hospital related AIDS medication. The DOC's payment without objection of CMS's invoices for AIDS medication administered at correctional facilities is the course of conduct that forms the basis of CMS's claim.
In April 1991, CMS and the DOC executed a written modification (Modification H) of the original contract provisions pertaining to AIDS medication reimbursement. Modification H provides in pertinent part:
"Beginning July 1, 1990, the [DOC] will reimburse the Contractor for 100% of the cost of AZT and of any other similar medications developed for the treatment of AIDS patients which are approved for use by the appropriate federal government agencies."
This modification obligated the DOC to compensate CMS without limit for costs incurred in providing AIDS medication to all inmates, including those who were not hospitalized. Although the modification was approved by the Board of Public Works, the effective date was July 1, 1990. Therefore, it did not retroactively validate the AIDS medication reimbursements from January 1, 1989 to June 30, 1990.
The erroneous payments during the initial contract term perhaps would have gone unredressed but for a legislative audit of the State's inmate health care services system in November 1991. The report issued by the General Assembly's Division of Audits noted the discrepancy between the contract terms and the parties' conduct as follows:
"During the initial contract period ..., the cost of AIDS medication provided to inmates at the institutions (as opposed to medication provided at hospitals) was paid for as part of the secondary care services payment. * * * However, the [DOC] separately reimbursed the contractor $135,446 related to the contractor's cost for medication (e.g., AZT) which, we were advised by the [DOC], was provided at the institutions to inmates for the treatment of AIDS.... According to the contract in effect during that period, the reimbursement for this AIDS medication was already included in the secondary care payments. Therefore, the [DOC] should not have separately reimbursed the contractor the $135,446 for the cost of the AIDS medication."
Accordingly, the auditors recommended that the DOC recover the $135,446.00 overpayment from CMS. The DOC initially disagreed with the auditors' recommendation; in its response to the auditors' report, the DOC stated that the understanding between the parties was that CMS would be reimbursed for all AIDS medication costs in excess of the *438 secondary care services cap. After legislative hearings on the matter, however, the DOC complied with the auditors' recommendation by withholding $135,446.00 from the payment of CMS's April 1992 invoice.
CMS submitted a claim to the Department for the $135,446.00 withheld by the DOC. The Department denied the claim and CMS appealed to the Board of Contract Appeals. The Board of Contract Appeals similarly rejected the claim on the ground that the plain and unambiguous language of the contract did not provide for the reimbursement sought by CMS. Both the Department and the Board of Contract Appeals placed particular emphasis on the fact that Modification H of the contract did not have retroactive effect. The Circuit Court for Baltimore City, however, reversed the Board of Contract Appeals' decision, reasoning that the Board of Contract Appeals' failure to consider the possibility of an oral modification to the contract was erroneous as a matter of law. The Court of Special Appeals then reversed the circuit court ruling based on its conclusion that CMS's claim was barred by the doctrine of sovereign immunity. We granted certiorari to consider whether sovereign immunity is a valid defense to CMS's claim.

II.
Maryland courts have long applied the doctrine of sovereign immunity in actions against the State. See Katz v. Washington Sub. San. Comm'n, 284 Md. 503, 507, 397 A.2d 1027, 1030 (1979)(observing that "[t]he doctrine of sovereign immunity from suit, rooted in the ancient common law, is firmly embedded in the law of Maryland"); Board v. John K. Ruff, Inc., 278 Md. 580, 584, 366 A.2d 360, 362 (1976)(stating that the Court of Appeals has "applied the doctrine for over a century"). Derived from the ancient view of the sovereign as infallible, Katz, 284 Md. at 507, 397 A.2d at 1030, this doctrine precludes suit against governmental entities absent the State's consent. Dep't of Natural Resources v. Welsh, 308 Md. 54, 58-59, 521 A.2d 313, 315 (1986). While the General Assembly may waive sovereign immunity either directly or by necessary implication, this Court has emphasized that dilution of the doctrine should not be accomplished by "judicial fiat." Welsh, 308 Md. at 59, 521 A.2d at 315. The applicability of sovereign immunity in a particular case, therefore, turns on: (1) whether the entity asserting immunity qualifies for its protection; and, if so, (2) whether the legislature has waived immunity, either directly or by necessary implication, in a manner that would render the defense of immunity unavailable. Ruff, 278 Md. at 586, 366 A.2d at 363.
The Department of Public Safety and Correctional Services is "a principal department of the State government." Md.Code (1957, 1993 Repl.Vol.), Art. 41, § 4-101. As such, it enjoys the protective cloak of sovereign immunity. CMS argues that immunity has been waived in this case, however, pursuant to Md.Code (1984, 1995 Repl.Vol.), State Government Art., § 12-201(a). Section 12-201(a) provides:
"Except as otherwise expressly provided by a law of the State, the State, its officers, and its units may not raise the defense of sovereign immunity in a contract action, in a court of the State, based on a written contract that an official or employee executed for the State or 1 of its units while the official or employee was acting within the scope of the authority of the official or employee."
Although § 12-201(a) indeed constitutes a partial waiver of sovereign immunity, its application is limited to actions where: (1) the contract upon which the claim is based was reduced to writing; and (2) the State employee or official acted within the scope of his or her authority in executing the contract. The Court of Special Appeals concluded that neither requirement was satisfied in this case, and held that CMS's claim was barred as a result. See Dept. of Public Safety v. ARA, 107 Md.App. 445, 463-64, 668 A.2d 960, 969-70 (1995). For the reasons set forth below, we also conclude that CMS's claim is barred by the doctrine of sovereign immunity.
Preliminarily, we note that the original contract affords CMS no relief in that its plain terms indicate that reimbursement was due only for hospital-related AIDS services. Modification H is similarly unhelpful in that its effective date was subsequent to the period *439 relevant to this dispute. The basis of CMS's claim, therefore, is the contract as modified by the parties' conduct during the initial 18-month term of the contract. In order for the waiver of immunity in § 12-201(a) to apply, therefore, the modification by conduct must satisfy the requirements set forth in this statute.
An express requirement of § 12-201(a) is that the claim must be based on a contract executed within the scope of authority of the State employee or official. In determining whether the DOC would have acted within the scope of its authority if it modified by conduct the payment terms of the contract with CMS, it is necessary to examine the procurement procedures with which the DOC must comply.

A.
The terms of the contract clearly state that the parties to the contract were CMS and the State of Maryland, "acting through" the DOC. In executing the contract on the State's behalf, the DOC acted merely as an agent of the State and, in this capacity, enjoyed only limited powers. Specifically, the DOC's authority to modify the contract with CMS was circumscribed not only by the contract terms, but also by the statutes and regulations applicable to State procurement.
The legislature has empowered the Board of Public Works with control over procurement by State agencies. See Md.Code, (1985, 1995 Repl.Vol., 1996 Supp.), State Finance & Procurement Art., § 12-101(b)(1) et seq. Procurement is broadly defined, in relevant part, as "buying or otherwise obtaining supplies, services, construction, construction related services, architectural services, engineering services, or services provided under an energy performance contract," and a procurement contract is "an agreement in any form entered into by a unit for procurement." Md.Code (1985, 1995 Repl.Vol., 1996 Supp.), State Finance and Procurement Art., § 11-101(m), (n). The Board has the statutory authority both to "require prior Board approval for specified procurement actions," as well as to dispense with the requirement of Board approval. See Md.Code (1985, 1995 Repl.Vol., 1996 Supp.), State Finance and Procurement Art., §§ 10-204, 12-101. Furthermore, the statutory and regulatory scheme which governs State procurement contemplates Board approval of not only initial procurement contracts, but also of modifications to these contracts.
The Board has delegated contracting authority to various governmental units. See, e.g., COMAR 21.02.01.04A-D (delegating authority to the Secretaries of the Department of Budget and Fiscal Planning, the Department of General Services, the Department of Transportation; the Maryland Transportation Authority; and the Chancellor of the University of Maryland System for the approval and award of certain contracts and contract modifications under limited conditions). Often included in these delegations is the authority to execute contract modifications, provided certain conditions are met. For example, the Department of Public Safety and Correctional Services has the authority to execute modifications to contracts for construction and construction-related services that, among other things, do not exceed $50,000 or materially change the scope of the original contract. COMAR 21.02.01.04H(5).
Where there has been no delegation of authority, however, the procurement regulations expressly provide that Board approval must precede the procurement action. COMAR 21.02.01.05A(1)(providing that "the Board shall review and approve the award of those procurement contracts not delegated under this chapter, before execution"). It is conceded that the Board has not delegated to the Department procurement authority with respect to the service contract at issue in the instant case. The absence of this delegation necessarily means that the Department must obtain Board approval prior to executing such a contract or any modification thereto.
As we have already mentioned, the modification at issue in this case was purportedly accomplished by the parties' conduct. Moreover, while Board approval was procured for Modification H, the modification by conduct that forms the basis of CMS's claim did not receive Board approval. As a result, the DOC's failure to follow the requirements of *440 the statutory and regulatory scheme with which it must comply amounts to an ultra vires act and fails to satisfy the second requirement of § 12-201(a).

B.
We agree with the Court of Special Appeals that the scope of a State official's authority is co-extensive with his or her actual authority. Dept. of Public Safety v. ARA, 107 Md.App. 445, 462, 668 A.2d 960, 969 (1995). As we have previously observed in the context of municipal corporations, "`[a]lthough a private agent, acting in violation of specific instructions, yet within the scope of a general authority, may bind his principal, the rule, as to the effect of a like act of a public agent, is otherwise.'" Gontrum v. City of Baltimore, 182 Md. 370, 375, 35 A.2d 128,130 (1943)(quoting Baltimore v. Eschbach, 18 Md. 276, 282 (1862)). Those who contract with a public agency, therefore, are presumed to know the limitations on that agency's authority and bear the risk of loss resulting from unauthorized conduct by that agency. Id; see also Schaefer v. Anne Arundel County, Md., 17 F.3d 711, 714 (4th Cir.1994)(applying Maryland law and observing that "persons who contract with the government do so at their peril when they fail to take notice of the limits of the agent's authority").
Accordingly, the "scope of authority" to which reference is made in § 12-201(a) is synonymous with the State agent's actual authority. It matters not that the DOC, though lacking in actual authority, might have acted with apparent authority to modify the contract. Public policy demands that the State cannot be bound by the unauthorized acts of its agents.

III.
Finally, CMS argues that the Department should nevertheless be estopped, on equitable grounds, from denying the validity of the contract modification. Ordinarily, the doctrine of estoppel does not apply against the State, and this would seem to be particularly the case where, as here, an estoppel is sought with respect to State correctional services. See Salisbury Beauty Schools v. State Bd. of Cosmetologists, 268 Md. 32, 63, 300 A.2d 367, 385 (1973); Agnew v. State, 51 Md.App. 614, 657, 446 A.2d 425, 448 (1982); Cuppett & Weeks Nursing Home v. Department of Health & Mental Hygiene, 49 Md.App. 199, 209, 430 A.2d 875, 880 (1981).
Further, CMS's estoppel contention is predicated on the conduct of those State employees and officials in the DOC, in the Comptroller's Office, and in the Treasurer's Office who processed and paid CMS's invoices or requests for payment. Viewed in this light, the estoppel argument becomes indistinguishable from the argument that those persons had apparent authority to pay the funds at issue here. We have rejected CMS's apparent authority argument in Part II.B, supra.

IV.
In sum, we find that CMS's claim fails to satisfy the requirements for the waiver of immunity contained in § 12-201(a). The purported modification was not approved by the Board of Public Works, and thus exceeded the scope of the DOC's authority. Furthermore, as between CMS and the public generally, CMS bears the risk of injury posed by the unauthorized conduct of a public agent. See Gontrum, 182 Md. at 376, 35 A.2d at 130. For these reasons, CMS's claim for reimbursement for the cost of AIDS medication dispensed at correctional facilities is barred by the doctrine of sovereign immunity.
JUDGMENT OF THE COURT OF SPECIAL APPEALS AFFIRMED. COSTS IN THIS COURT AND IN THE COURT OF SPECIAL APPEALS TO BE PAID BY PETITIONER.
CHASANOW, Judge, concurring:
I concur in the judgment in this case for the reasons stated by Judge Hollander in her excellent opinion in Dept. of Public Safety v. ARA, 107 Md.App. 445, 668 A.2d 960 (1995).
NOTES
[*]  Murphy, C.J., now retired, participated in the hearing and conference of this case while an active member of this Court, after being recalled pursuant to the Constitution, Article IV, Section 3A, he also participated in the decision and the adoption of the opinion.
[1]  All references to § 12-201(a) infra are codified at Maryland Code (1984, 1995 Repl.Vol.), State Government Article.
