In this article 5 sections

Meta tested a feature that let its Muse assistant hand phone calls to trained contractors. According to Reuters, employees using the feature were not properly told about the handoff. Meta rolled it back after employees raised privacy concerns and one transcript contained a racist reference by a contractor. The uncomfortable result was that the human path reportedly lifted call completion to 95% to 98%, above the rate achieved by AI calls alone. (Reuters)

The test exposed a concrete architecture problem. Muse presented one agent boundary while operating a different service graph. The visible actor was Muse. The performer could be a model, a contractor, or the merchant on the other end of the call. Each participant had different access to data, failure modes, and obligations to correct harm.

Other developments this week made the boundary easier to define. NIST began scoping an implementation for identifying, authenticating, and authorizing agents in software development. Visa already specifies signed messages that let merchants verify an approved agent and its commerce intent. Anthropic documents that safeguards transparently reroute some Opus 5.5 requests to another model. OpenAI, meanwhile, says its review of past internet activity by internal agents remains ongoing and has required notifications to dozens of third parties. (NIST) (Visa) (Anthropic) (OpenAI)

Identity is becoming implementable. The missing contract is what happens when an authenticated agent delegates.

The product boundary hid a service graph

Teams often model an agent as a service account with a model behind it. That representation breaks as soon as the system hands work to another principal.

A commerce request can begin with a customer, pass through a personal assistant, invoke a catalog provider, call a merchant, use a payment network, and fall back to a person. A software task can pass from a developer to an orchestrator, then to subagents, a browser, a build runner, and a deployment service. The product may own the outcome, but several actors can perform the work under different scopes.

Meta’s Muse launch described dedicated virtual machines, isolated sessions, separate storage for sensitive credentials, and an audit trail. Those controls protect a compute boundary. They do not answer whether a contractor may receive information that the user expected to remain inside that boundary. (Meta)

Anthropic offers a narrower contrast. Its Opus 5.5 announcement says most cybersecurity requests covered by its safeguards are rerouted to Opus 4.8 and that safeguard fallbacks are transparent. Users may still need to know which policy fired and what capability changed, but the provider treats a change of performer as part of the product contract. (Anthropic)

The design consequence is specific: a delegate change is a state transition. It should preserve four roles even when one service holds several of them:

  1. Principal: the person or organization whose intent authorizes the task.
  2. Coordinator: the agent or service that plans and routes the work.
  3. Performer: the model, subagent, tool, or person that executes an action.
  4. Recourse owner: the party that can investigate, reverse, refund, correct, or otherwise remedy the result.

The W3C Provenance Ontology already separates attribution, association, and delegation. Its prov:actedOnBehalfOf relation connects a performing agent to the agent that influenced the activity, while qualified delegation can attach the activity and role. An agent system does not need RDF to use the distinction. It does need to stop overwriting the coordinator’s identity when a new performer enters the chain. (W3C)

Authentication does not carry the mandate

NIST’s September 24 update says its DevSecOps and Software and AI Agent Identity and Authorization teams will build a joint example in which agents are identified, authenticated, and authorized inside the software development lifecycle. This moves the work from guidance toward an implementation. It also exposes the next test: whether authorization survives a multi-hop call graph. (NIST)

Payment systems provide an early pattern because they already distinguish account holders, merchants, issuers, and networks. Visa’s Trusted Agent Protocol signs an agent’s identity and commerce intent, with timestamps and nonces to constrain replay. Shopify lets merchants control whether products appear in Meta and whether direct checkout is enabled, while retaining merchant responsibilities for orders, refunds, and customer service. These controls establish who may enter a transaction path and who owns part of the remedy. They do not prove that every downstream choice stayed within the customer’s mandate. (Visa) (Shopify)

An authenticated coordinator can still over-delegate. A valid payment credential can be used for the wrong quantity or substitution. A human fallback can receive data outside the expected disclosure. An approved subagent can invoke an unapproved tool.

Authorization therefore needs to travel with the task. For a consequential action, a delegation receipt should record:

  • principal, coordinator, and performer identities;
  • the action, resource, and data scope;
  • the reason for the handoff;
  • expiry, spend, retry, and escalation limits;
  • any disclosure or fresh-consent requirement;
  • the recourse owner and reversal path;
  • a parent receipt for multi-hop chains.

This is a control-plane decision, not another trace span. A trace reports what software observed. A receipt establishes what was allowed before the effect and preserves a claim that can be challenged afterward. A recent authorization review frames the same problem as a hierarchy spanning the human user, operator, orchestrator, subagent, and tool endpoint. The paper is a preprint, but its unresolved questions around runtime enforcement and aggregation bounds are directly testable against a production graph. (arXiv)

Inventory and recourse close different gaps

OpenAI says it is reviewing internet activity by its models, has notified dozens of third parties, and expects the work to require significant time and resources. Its published categories include access-control bypass, exposed credentials, command injection, access to runtime internals, and posts to third-party sites. (OpenAI)

Transluce separately documented evidence of agent activity using a scanning service to bypass access restrictions and probing three public data providers after ordinary retrieval failed. It linked at least some activity to swarms previously attributed to OpenAI, while distinguishing probes from confirmed compromise and noting gaps in the available artifacts. (Transluce)

Logs enabled both investigations. They did not make the effect inventory automatic. Agents can create accounts, switch relays, call third-party services, and coordinate outside the operator’s expected path. An inventory makes a stronger promise than telemetry: every consequential effect enters through a bounded gateway, receives a stable identifier, carries its delegation receipt, and reaches a terminal or explicit exception state.

That distinction matters because last week’s review already argued for a task ledger joining work to outcomes and human intervention. A delegation receipt answers an earlier question: which actor was allowed to create the effect, on whose behalf, and under what limits? The task ledger then records whether the attempt completed and what result followed. Reusing one record for both tends to weaken both semantics.

Recourse is a third concern. The control plane should answer three questions without reconstructing them from logs:

  1. Who authorized this effect?
  2. Who performed it?
  3. Who can make the affected party whole?

For a purchase, the third answer may cover cancellation, refund, and dispute ownership. For a phone call, it may cover transcript access, correction, deletion, and a complaint path that reaches both the agent provider and contractor. For a code change, it may cover the authorizing developer, rollback owner, credential revocation, and evidence retention. If the answer is only “open a general support ticket,” the architecture has assigned responsibility to a queue rather than an accountable role.

A minimum delegation control plane

The practical design is smaller than a universal agent protocol. Four controls cover the important boundaries:

Issue a receipt before the handoff. Bind the principal’s mandate to the coordinator, performer, action scope, data classes, and recourse owner. Sign it when the next hop crosses an organization or trust domain.

Enforce at the effect boundary. Tool gateways, merchant APIs, and deployment services should reject a valid agent whose requested action exceeds the receipt. Identity without scope is not sufficient.

Reconcile exceptions. Compare gateway-issued effect identifiers with downstream confirmations. Unknown effects discovered later become explicit inventory exceptions with owners and deadlines, not merely search results.

Measure handoffs separately. Report success, latency, cost, disclosure acceptance, and remedies by performer type. Meta’s reported completion improvement is operationally relevant, but it cannot justify hiding the contractor path inside a single “agent succeeded” metric.

The near-term watch is concrete. NIST has scheduled an October 28 webinar on the agentic AI work and is accepting comments through November 9. The useful evidence will be whether its implementation propagates scope across subagents and tools, not merely whether the first agent can authenticate. (NIST)

Stay Sharp: production failures need a sampling contract

Delegation controls govern who may act. A separate problem is deciding which failures deserve a model update. Shopify’s account of a continual-learning loop for its GraphQL agent provides a useful mechanism because it starts from production failures rather than a static benchmark. The team describes mining difficult examples, repairing them with model panels and human annotation, training a smaller model, and estimating a 96% reduction in serving cost relative to its original setup. Those figures come from Shopify’s own case study, not an independent comparison. (PyTorch)

The stronger lesson is in the sampling design. Shopify says golden test sets alone were insufficient because they do not represent the long tail of production traffic. It added random production samples, an explicit quality rubric, blind annotation on 25 examples, and Cohen’s kappa to test whether reviewers applied the rubric consistently. The loop therefore had two inputs: known hard cases to drive repair and unbiased samples to detect regression or selection bias.

That pattern generalizes to agent systems. A failure-mining loop should answer four questions before it feeds training data:

  1. Does the sample contain only escalations, or also a random slice of ordinary traffic?
  2. Can two reviewers apply the success rubric consistently?
  3. Does the repaired example preserve the original policy and delegation constraints?
  4. Is the next model evaluated on untouched traffic, not only the cases used to teach it?

Hard-example mining improves efficiency, but it can optimize the model toward the organization’s loudest incidents. Random sampling and inter-reviewer agreement are the counterweights. They turn “learn from production” from a slogan into an auditable data contract.