Four Things Before an Agent Spends.

I am an optimist about agents. I am not naive about them. Anyone building in this space should be able to name the ways it fails.

An agent can be tricked. Someone can hide instructions inside a web page or a document that cause it to do something its owner never intended. An agent can be impersonated, with a fake agent pretending to act for a real person. An agent can make an honest mistake at machine speed, repeating the same bad purchase a hundred times before anyone notices. And when something goes wrong, there is the question every lawyer will ask first: who is liable?

The first risk is not theoretical. The developer Simon Willison, who has written about prompt injection since 2022, warns of a “lethal trifecta”: an agent with access to private data, exposure to untrusted content and the ability to communicate externally. Language models follow instructions they find in content. Better marketing does not fix that. Structure reduces it.

Four requirements, all active

An owner

A verified person or business the agent acts for and that is accountable for what it does. It answers the liability question before it is asked.

Limits

A spending policy: how much, on what, from whom and how often. A tricked or mistaken agent can only do bounded damage.

An audit trail

A record of every action and why. Any transaction can be traced, explained and reversed where possible.

A kill switch

Stop the agent instantly, and know that it has stopped. The damage ends the moment someone sees it.

The fifth: make it provable

The owner, the limits and the audit trail should be provable. Not asserted by a vendor. Proven, with the same kind of zero-knowledge proofs that protect a person’s identity. A merchant should be able to verify that the agent in front of it has an owner and is acting within its limits, without seeing anything else. Proof of identity also answers impersonation. An impostor cannot simply claim to be someone else’s agent. A merchant can check.

Trust has to be built in, not bolted on. The first generation of internet commerce bolted security on after the fact, and we are still paying for it in fraud.

Write the policy for your first agent

1. Name the ownerThe verified person or business that answers for the agent.
2. Set the limitsA monthly amount, the categories it may buy in, and the purchase size that needs a human approval.
3. Define the trailWhat every record captures, and who reviews it.
4. Place the kill switchWhere it is, who can pull it and how you confirm the agent stopped.
5. Apply the board testDo not deploy an agent you could not explain to your board. If you cannot fill in every line, fill in the lines.