Capability arrived before the controls
Most of the tooling being built right now optimises for what an agent can do. Very little of it describes what an agent may do, in terms a person could read and check. That asymmetry is the whole problem.
Ask a simple question of any agent product: who authorised this action, against what rule, and where is the record? Usually the answer is a prompt, somewhere, that nobody has read in weeks.
It is an uneasy feeling, finding a sent message you did not write. Not because the message was wrong, but because you cannot tell where the decision came from. Trust does not survive many of those moments.
How to design delegation people can trust
- Start with almost nothing. An agent begins with no scope and earns it, one explicit grant at a time.
- Write scope in human words. If a person cannot read the rule, they cannot check it.
- Make every action attributable. Each action should point back to the rule that allowed it and the person who wrote it.
- Separate reversible from irreversible. Let the agent act freely where mistakes can be undone, and ask where they cannot.
- Review the rules, not the clicks. Check scope regularly instead of clicking through confirmations you no longer read.
None of this is settled. It is slower to build this way, but it means the first question we can answer is the one that gets asked in a review: not what happened, but who decided it could.
