Capability Is Not Permission
The agents arriving this year can do things. They book travel, move money between accounts, file forms, negotiate with other agents, send messages in your name. Every demo celebrates the capability, and the capabilities are real. Almost none of the demos say a word about the mandate, and I have come to think the mandate is the whole question.
Capability is what a system can do. Permission is what it is allowed to do, on whose behalf, within what bounds, and for how long. The two have nothing to do with each other, and the history of every system that handles consequence is the history of keeping them apart.
What payments already knew
I spent a long stretch of my career in payments, and payments taught me this distinction before I had a name for it. A card can pay for anything. It has no idea what it is for. What happens when you tap it is an authorization: this amount, at this merchant, at this moment, and a bank somewhere approves or declines it in a fraction of a second by checking those bounds against your history and your standing permission. The capability was always total. The permission was always specific.
Around that distinction, the industry built an entire architecture. Limits that the cardholder cannot override from the terminal. Expiry dates. The ability to cancel a card and have the cancellation take effect everywhere at once. A ledger that shows you every use of your authority after the fact. Two signatures on anything large. A power of attorney that names the acts it covers and is void for everything else. None of this was elegant. All of it existed because people had learned, expensively, that a thing able to act on your behalf will eventually act in a way you did not intend, and the only protection is to have said in advance what you did intend, in terms a machine can check.
Where the agents are today
AI agents are being deployed with that architecture missing. The grant of authority is a sentence in a settings page. "Handle my inbox." "Manage my calendar." "Buy what I need for the trip." These are not mandates. They are capability grants with the scope left blank, and a blank scope always gets filled by whoever did not write it. The agent fills it with whatever its training suggests a reasonable person meant. Sometimes that is right. The times it is wrong are the ones that end up in a dispute, and there is no dispute process for an email you did not mean to send.
The harder problem is that the capability is growing much faster than the vocabulary for bounding it. We can give an agent the power to spend. We do not yet have a common way to say: up to this amount, from this account, with these merchants, until Friday, and never anything that cannot be refunded. Those are not exotic requirements. They are what a corporate card program has had for thirty years. They are absent from most agent products because the products were built by people racing to show what the agent could do, not what it should be stopped from doing.
What a mandate for a machine would look like
I do not think this needs invention. It needs borrowing, from the regulated world that has run on delegated authority for a long time.
Scope, stated. Which accounts, which counterparties, which kinds of action. Not "my finances." This account, these payees, transfers but not new payees.
Limits, enforced outside the agent. A ceiling on money, on messages sent, on anything irreversible, and the ceiling has to live somewhere the agent cannot reach. A limit the agent is asked to respect is a suggestion. A limit the processor enforces is a limit.
Expiry. Standing authority is the most dangerous kind, because nobody remembers granting it. Authority should lapse and have to be renewed, and renewing it should show you what was done under the last grant.
Revocation that works. One step, immediate, everywhere. If stopping the agent requires finding the right menu in each of six services, you have not retained control. You have retained the appearance of it.
A ledger. Every action, the authority it was taken under, and the reasoning, legible to the person it was done for. The point of a ledger is not that you will read it every day. It is that when something goes wrong you can find out what happened without the agent's help.
A second signature for the irreversible. Anything that cannot be undone, and in a world of agents that includes a sent message, a signed agreement and a payment to a stranger, should pause for a human. Not every action. The ones with no way back.
Why this is not about the machines
It would be easy to tell this as a story about agents that want too much. It is not that story. Today's AI wants nothing. It does not reach for authority. It fills the scope it was handed, and when the scope is blank it fills it with an average of what people usually mean, which is exactly the behavior you would expect from a very capable system with no stake in the outcome. The danger is not the agent's ambition. It is ours, and our impatience with the boring work of saying exactly what we meant.
Nobody knows what self-improving systems will be able to do, and I am not going to pretend otherwise. But I am sure of one thing about them, because it is true of every powerful system we have ever built: more capable is never more human. A system that can do more has not, by that fact, earned permission to do more. Permission is a decision a person makes, in advance, in words, with bounds. It cannot be inferred from power, and the moment we let it be, we have handed over the one thing that was ours to keep.
Build the authorization layer. Build it before the agents are good enough that nobody wants to slow them down. Payments did it after the losses. We have the rare chance to do it before.