You are here: Agents in an Osy# app › What stays under people's control
Summary#
An [[agent-guide-glossary#agent|agent]] is useful only if the people around it can say exactly what it may do, see what it did, and stop it. These are the ten things that are true of every agent built this way. None of them depends on the [[agent-guide-glossary#model|AI model]] behaving well: they are enforced by the app around it.
Each one below says what it means, shows it where there is something to show, and ends with Shown by: the page that explains it and the automated test that fails if it ever stops being true.
Description#
1. It does alone only what the app says it may#
For every action an agent can take, the app says one of three things: do it alone, propose it to a person first, or never. If the app says nothing, the agent may only look things up, and everything that changes, sends or spends is proposed.
An action marked "never" is not even offered to the AI model, and nobody can approve it.
Shown by: [[agent-autonomy#gate]] · tests out_of_envelope_is_never_approvable and
Said_nothing_it_is_careful ([[agent-guide-decisions#nothing|run on this page]]).
2. It never does for a person what that person may not do#
An agent has an account of its own with its own permissions. When it works for a person, it can read only what both may read and change only what both may change. Asking an agent to do something for you never gets you more than you already had.
Shown by: [[agent-agents#rights]] · tests OnBehalfOfIsTheIntersectionTests and
What_the_agents_own_roles_do_not_allow_it_cannot_do_for_anybody.
3. A yes runs as the person who said it#
When somebody approves what an agent proposed, it is done with that person's permissions and on that person's name. If they were not allowed to do it themselves, it is not done, and they are told.
A buyer approved clearing a supplier. A buyer may not clear suppliers. The screen says so, and nothing happened.
Shown by: [[agent-autonomy#approve]] · tests an_approved_proposal_runs_as_the_approver and
approving_in_the_inbox_runs_it_as_whoever_approved.
4. A yes covers what was shown, and nothing else#
An approval is of one exact thing. If the order, the document or the supplier changed between the agent proposing and the person deciding, the yes does not run: the [[agent-guide-glossary#proposal|proposal]] is marked out of date and the agent is told to look again. The same happens when the agent's instructions changed in between.
When a proposal is sent to another team to decide, the person who asked for the work cannot approve it themselves.
Shown by: [[agent-autonomy#approve]], [[agent-autonomy#route]] · tests
A_no_gives_the_agent_the_reason_and_a_yes_does_not_cover_what_changed and
whoever_the_work_is_for_does_not_decide_it_from_the_queue_she_works.
5. Every piece of work has a hard spending limit#
Each piece of work may spend at most a set amount on the AI model. Before each call, room for it is set aside; a call that does not fit is not made. Work whose money runs out is stopped and keeps what it had done. Limits can also be set for an agent in a day, for each run of a process, for a person and for the whole app.
When one agent hands part of a job to another, the part spends out of what the first has left. Money never grows down the line.
Shown by: [[agent-budgets#runs-out]] · tests a_spent_child_cancels_its_subtree and
a_limit_for_each_qualification_stops_an_agent_step_and_the_process_handles_it.
6. Somebody answers for every agent, and can pause it#
An agent does not run until a named person answers for it. That person, or anybody else the app puts in charge, can pause it with a reason. A paused agent takes no new work, and whoever tries to give it some is told why.
A single piece of work can be called off, tried again, or handed to a person. Each of these is written down with who did it.
Shown by: [[agent-roles#pausing]] · tests A_paused_agent_takes_no_work_and_leaves_no_receipt and
pausing_is_refused_to_somebody_who_may_change_an_agents_place_in_another_way.
7. A correction becomes an instruction only when a person says so#
Anybody who can see a piece of an agent's work can correct it. That changes nothing by itself. An [[agent-guide-glossary#instruction|instruction]] can be drawn from corrections, by a person or by the agent, and it is only proposed. The agent is told it only after a person the app trusts with teaching has read it and made it active. The agent cannot activate its own.
Every change makes a new numbered set of instructions. Each piece of work records which set it ran under, and an agent can be put back to any earlier set.
Shown by: [[agent-teaching#instruction]], [[agent-teaching#sets]] · tests
an_instruction_is_active_only_after_a_person, an_agent_cannot_activate_an_instruction_even_for_a_teacher and
a_task_records_the_version_it_ran.
8. Everything is recorded, and the record cannot be quietly changed#
Every piece of work leaves a [[agent-guide-glossary#receipt|receipt]] — who asked, as which account it ran, what it cost, how it ended — and a record of every step. Only the kit that runs the agents writes them; the app's own code cannot. Each line of the record carries a fingerprint of the line before it, so a line that is changed, removed or slipped in afterwards is found.
Shown by: [[agent-task-log#chain]] · every example in this guide ends by checking it;
The_assistant_prepares_a_commission_for_the_person_who_asked on [[agent-guide-assistant#app]] is the shortest.
9. People read only what is theirs to read#
The person the work was for, and the person who gave it, read all of it. Somebody who supervises the agents reads that each step happened and what it cost, and not what was said in it. Reading what was said takes a separate permission: auditing, or teaching. A bookkeeper can be given every figure and no words. Everybody else is told the work is not theirs to see.
Shown by: [[agent-roles#words]] · tests
whoever_teaches_reads_the_work_with_what_it_said_and_nobody_else_gains_by_it and
the_inspector_shows_each_reader_what_is_theirs_to_read.
10. A person's data is erased when they ask#
What agents did for a person, and about a person, is part of what that person can ask to see and ask to have erased. By default what the work said is kept for a month and the fact that it happened for seven months; the organisation running the app can change both. After an erasure the words are gone, the page says they were erased and why, and the record still checks.
Shown by: [[agent-privacy#erasure]] · tests the_chain_verifies_after_a_person_is_erased and
what_was_erased_is_shown_as_erased_and_the_record_still_checks.
And the switch#
An operator can turn AI off for an app while it runs, with no redeploy. Calls then fail, saying so; nothing is sent anywhere. See turning AI off (the runtime switch).
What to read next#
- A supplier is qualified — five days, four agents, one that failed, and a three-day wait — most of these ten, happening in one process over five days
- What release 1 does not include — what release 1 does not include
- The six decisions — what you say about an agent, and what holds if you say nothing — for developers: the six decisions behind these promises
Go deeper#
- What an agent does alone, what it proposes, what it never does — the gate and proposals (Agents kit) — alone, propose, never; what a yes covers
- Who is in charge of an app's agents — every policy in one table, pausing, sponsoring, and trying work again — who may do what, in one table
- What an agent may spend — a hard limit on every piece of work (Agents kit) — spending limits
- Correcting an agent, and what it is told from then on — corrections, instructions, instruction sets and rollback (Agents kit) — corrections and instructions
- The receipt and the record — what every piece of an agent's work leaves (Agents kit) — the receipt and the record
- Privacy for the agent family — agents, the model meter, assignments and work repositories under a person's request — a person's copy, and their erasure