Hiring and retiring an AI worker

An API key says an agent exists. It does not say who answers for it, what it is for, how much it may commit the company to, or how to stop it. Those are the things a company needs before it lets software act in its name, and they are what a grant carries.

Everything here lives under Agents in the console, and every one of these routes has an API beside it.

Hiring

1. 1

   Say what it is for

   A label, and the actions it handles as namespaced verbs — payment.refund, email.send. This is what answers "which agent should handle this" when another agent finds work outside its own remit.

   Leaving it blank means the agent is never proposed for work. It does not mean it may do everything: silence about what an agent is for is not a claim about what it may do.

2. 2

   Name who answers for it

   The owner is the person accountable when it misbehaves. Deliberately three different people in the general case: its principal is who it acts for, createdBy is whoever ran the mint, and the owner is who you call.

   You need that distinction the first time an agent surprises you at 3am and the person who set it up left the company.

3. 3

   Set what it may commit alone

   A spend limit is enforced, unlike the written restrictions below it. Anything larger comes back needing a person even where no rule forbids it.

   An action that will not say how big it is does not pass a ceiling — an agent with a limit could otherwise clear any amount by omitting it.

4. 4

   Decide how much it is told

   The clearance, and the audiences it reaches. Separate from everything above, because what an agent may do and what it may know are two decisions. Restricted material never reaches a machine whatever you set.

An agent may not out-read the person it acts for

A grant naming a principal is narrowed to them: the lower ceiling, and only the audiences they are both in. An admin who grants an agent reach into Legal while its principal sits in Finance has granted nothing.

This is what makes delegated authority mean something. Alice approving fifty thousand does not make Alice's assistant able to.

Temporary authority

"Let this agent read the financial report for the next two hours" is a different grant from a standing one, and the difference has to be enforced rather than remembered. Set an expiry and the authority lapses on its own.

Stopping one

Two different acts, and the console offers both because they are different decisions.

Halting keeps the credential and everything the agent has asked. That is deliberate: the investigation into what it did needs to know which agent asked what, and destroying that to stop it would trade the evidence for the containment. A halt requires a reason, and the reason is shown to whoever lifts it.

Knowing what you are running

The agent list says why each one is silent rather than leaving you to work it out from three fields:

A halted or lapsed agent stays in the list. An agent that has quietly stopped doing its work while looking healthy is the failure this view exists to prevent.

Retiring

Revoking takes effect on the agent's next question. What it has already been told is not recalled — nothing can un-tell it — but it asks nothing further, and it stops being offered as somewhere to route work.

The ledger survives. "Which agent did this, on whose behalf, and what was it told" has to stay answerable after the agent is gone, which is the whole point of keeping the record separate from the credential.