This week something remarkable happened. A big tech CEO acknowledged that we apply agents the wrong way when we put them to work in production. Although it was for the wrong reason, a selfish one, it’s the right way to go.
Satya Nadella wrote: “we need to separate the supply of intelligence from the authority over it.”
That’s exactly it. Intelligence is one thing (despite the argument on its definition). The authority to use it is another, and the real question.
Regardless, I wondered where this shift came from, so I looked at what actually shipped this same week.
And surprise, it was another judge. Plus another one, and another one.
Four judges in one week
Microsoft’s security chief Hayete Gallot: “Unfortunately, frontier models, regardless of their origin, cannot be trusted.” Her answer is Guardian Agents. Agents that watch other agents.
Notion added “Review for me”. It “uses a separate model to check whether an action is safe before the agent takes it.” A model that watches the model.
Claude Duet, still in research preview to be fair, “checks with you before it acts on your behalf.” So it’s you, watching the model.
And Anthropic is pitching its own draft bill to lawmakers in Washington, reported by POLITICO. The Commerce Department could stop a model only with a court order, only for a “foreseeable, imminent threat”, and only above “$1 billion in damages or the deaths or serious injuries of over 50 people.” A court that watches the model, once it’s bad enough.
Four fixes. Each one is a judge, a guardrail. But each one comes in after the agent already wants to act.
That’s supervision. No conscience. No artificial “morals” or the like.
How we hand over work to people
Nobody hires an assistant and then puts a second assistant on top to read every email sent. You give him a scope. Book travel up to a limit. Sign off on small things. Anything above needs to be approved.
Then, he gets on with it. His boss doesn’t approve every booking. She checks the expenses at the end of the month.
With agents we do it the other way around. Task and login first, then one guardrail after another, to catch what it does with them. That won’t fly.
What authority actually means
Authority is decided before the agent runs. It comes down to four things:
What it may do.
For whom.
Up to what amount, and where it has to stop.
A record of what it did, that someone other than the agent can check.
Can you write your agent’s scope down in four lines like these? If not, you have a capable agent and a growing row of guardrails behind it.
Why this matters more than safety
An agent that has to ask permission for every step is useless. Nobody needs that.
Full agency is the point. But full agency inside a scope someone wrote down, and signed. Whoever puts the agent to work owns that scope and, needless to say, the responsibility for it. Not the lab. Not a second model. Not a court that shows up after 50 people got hurt.
Everyone’s asking the wrong question
The platforms ask if this one action is safe. The bill asks how bad it has to get before someone may step in. The cautious ask the human every time until the human stops reading.
I’d rather ask the questions a boss asks before handing over work:
What exactly is this agent allowed to do, and for whom?
Where does it stop?
Who checks what it did?
Nadella got the direction right. Intelligence is the supply while authority belongs to whoever puts it to work.
Plenty of guardrails by now. Still nobody set the scope AI can have full agency within.