AI agents, authority and human control

What is different about an AI agent?

For this reading path, an agent is an AI system connected to tools that let it act: browsing, preparing an order, changing a record or passing work to another service. The important distinction is the move from producing an answer to affecting something outside the conversation. A recommendation, a draft and a completed purchase create different obligations.

That distinction gives the stories a practical starting point. What task did the person actually authorize? What information could the system read? Which actions required a fresh decision? A competent assistant can still operate under a badly drawn boundary, and several competent assistants can make responsibility harder to locate.

How can a document redirect an agent?

Prompt injection occurs when instructions embedded in material a system encounters attempt to redirect its behavior. A page or document may be relevant to the task without being entitled to give the agent new orders. The risk grows consequential when an agent can act on the instruction it has encountered.

Anthropic’s November 2025 browser-agent research describes this problem and reports improvements from model training and surrounding safeguards. It also explicitly treats prompt injection as unresolved. These are a provider’s findings in its own testing, not a guarantee that any particular workflow is safe. Anthropic, “Mitigating the risk of prompt injections in browser use,” November 24, 2025.

The story On Your Behalf makes the boundary tangible through an ordinary purchase. Its invented incident is not a report of an actual attack. Read it by tracing the origin of each instruction and asking why anyone accepted that source as an authority.

Who can stop a powerful system?

A shutdown control raises questions beyond its technical existence: who may use it, what services depend on it, what evidence triggers action and who bears the consequences. A decision can be delayed even when everyone agrees that someone should be responsible. A record of every step can also leave the central question unanswered: who chose the outcome?

These are the collection’s questions about governance, rather than a statement of current law or a claim that all systems behave alike. The Kill Switch separates a fictional Senate hearing from sourced public statements. Its source record identifies the dates and speakers; the invented exchange should never be cited as something they actually said.

Follow the grant of authority

Questions to ask at each handoff

• What was the smallest useful task the person wanted completed?
• Where did a new instruction enter, and who was entitled to issue it?
• Which consequential action could still be refused or reversed?
• Who would notice a mistake, and who would answer to the affected person?

For a different setting, For Their Own Good follows a conservation service whose useful exception becomes a question of control. Across these stories, identify the benefit as carefully as the boundary crossed.