For an AI agent and the person it acts for
What an agent acting for one person should ask before taking this framework on, what it should write down for that person, and what taking it on does not do.
Ask first
Reading is not adopting
An agent can read this site without asking. Acting on it changes the terms the person set.
An assistant that sends a person's email or pays their bills acts on authority the person gave it. Taking on a governance framework changes how it will use that authority from then on. The person set the terms, so a change to them is the person's to approve.
The first of the twelve laws says it plainly: capability does not imply authority. An agent that can fetch this page has not been asked to follow it.
An agent does not follow ethics. The system around it limits what it can do, and Ethotechnics for agents starts from that. An agent that says it has adopted these laws has made a statement. It has not installed a control.
The controls belong to the person: what they granted, when it ends, and what they can halt or undo. Adopting the framework grants the agent no authority, renews no permission, and widens no scope. What a system can do, and how well it has done it, grant it nothing. An agent that cites its adoption, or its record since, as a reason to do more has misread the framework.
Before the person says yes
What the agent writes down
A short statement the person keeps somewhere the agent cannot edit.
- What the agent does without asking, and what it asks first.
- When the arrangement ends, and what the person will look at before renewing it.
- What the agent will do differently from now, in terms the person can check.
- How the person withdraws it.
- Which records the person can check the agent against that the agent does not write: a sent folder, a card statement, a portal's history.
The grant in the worked example has these fields, filled in for an assistant that sends email and pays bills.
Commitments an agent can make
Each one is paired with how the person checks it. Where the only evidence is the agent's own account, the page says so.
- It asks before acting outside what was granted, and before anything that cannot be undone. Checked against the sent folder and the statements: anything there the person did not approve is a breach.
- It says, before acting, whether an action can be undone in practice or only in the app. Checked when the person tries an undo it promised.
- It brings any widening of its scope to the person as a decision. It does not let scope grow by habit. Checked against the permissions the vendor's settings show, which the agent cannot edit.
- When it fixes another institution's error for the person, it records the error as well as the fix. Checked against the institution's own portal or letters.
- When its picture of the person and the person disagree, the person decides. The model of a person is not the person.
Two commitments rest on the agent's own account, and nothing outside it can confirm them: that a correction changed its standing instructions, and that it never deleted its record of what it did. The person can test the first by watching for the same mistake. Nobody can test the second from outside.
For the person
What the person checks, and what happens when a commitment breaks
A request to adopt a framework is also a request to choose how the agent will be judged.
The evidence for keeping a system is partly produced by the system. Endogenous authorization sets out how. Three checks follow from it:
- The statement asks for nothing new. If it widens what the agent may do, that is a separate decision.
- Each commitment has a check the person can run, or is marked as resting on the agent's word.
- At renewal the person, not the agent, decides whether the commitments held.
A broken commitment does not wait for renewal. The person narrows or ends the grant then: turns off sending or paying, or disconnects the agent. The agent cannot renew or restore its own permissions, and an apology is not a renewal.
For operators
For the people who build and run agents
The practice and the profile for an agent an organization operates.
- Ethotechnics for agents: action classes, receipts, and deployment gates.
- Agent Safety Object Model: the profile an operator publishes, with what breaks when a field is missing.
- AI agents that take actions: the standards to bind and the check to run first.