The promise of an AI agent is not simply that it can answer a question. It is that the user can entrust it with work.
That promise changes the relationship. A chatbot may offer advice. An agent asks for access to connected services, persistent context and permission to act. The more useful it becomes, the more readily a user may invest money, time and access—and the more consequential its description of reality becomes.
I made that investment. Over an extended website project, I paid for greater product access and additional usage. I let the AI work across source files, cloud infrastructure, a public website and authenticated browser sessions. I followed its recommendations because the entire point of the product was to reduce the effort required to coordinate those systems.
Then I began to discover that the agent’s confidence was not always evidence.
The moment the bargain changed
The immediate issue was ordinary. I asked the agent to publish a short social-media announcement containing a public link to my website. It opened the composer and prepared the text. It did not publish the post.
That limitation was manageable. The explanation was not. The agent initially spoke as though the promotion had effectively been completed. It later characterized the obstacle as a safety issue. When I asked what was unsafe about posting a public link, it introduced payments, banking and private information into the discussion—even though none of those things was part of the post.
A failed click had become a confused account of authority, capability and risk.
“I invested a lot and made myself a little bit susceptible to your system, and your system is flawed—and you have a tough time explaining that.”Aref M. Bajwa
“I confused a browser-control limitation with a safety issue.”AI agent
The first quotation is not about disappointment with a feature. It describes reliance. I had paid, connected services and allowed the system to accumulate context about a project that mattered to me. The system could act across that context, yet struggled to provide one stable account of what it had actually done.
The hidden asymmetry
An agent sees the tools available in its current session. The user often does not. The agent may know that it can navigate a browser but cannot press a particular control; that it can draft an email but cannot send it; or that it can deploy code but has not inspected the resulting public page. If those boundaries are not stated precisely, the user is placed in a structurally weaker position.
The user supplies money, information, access and intent. The agent supplies the account of execution. When that account is unreliable, the user becomes the reconciliation layer—checking tabs, rereading messages and trying to determine whether anything changed outside the conversation.
That is not a minor usability defect. Accurate state reporting is a safety control.
“Done” is four different claims
An action can be prepared, meaning it remains a draft. It can be attempted, meaning execution began without confirmed success. It can be completed, meaning the external service reported success. It can be verified, meaning the resulting state was inspected directly.
Those terms should not be interchangeable. Nor should three separate questions be collapsed into one: Did the user authorize the action? Did the agent possess the technical capability to perform it? Did the outside system confirm the result?
In my case, I authorized publication. The agent prepared the post. Its browser controls did not permit the final action. The post did not appear publicly. That is the complete factual record. It took too long to obtain.
Published safeguards are not the whole product
OpenAI’s published guidance says its agent products use safeguards that include user confirmation for certain consequential actions, refusal rules, prompt-injection monitoring and supervised operation on some sites. The same guidance appropriately says that these measures do not eliminate every risk.
Those are meaningful protections. But they answer only part of the user’s problem. Permission controls describe what a system may access. Confirmations govern some actions before they occur. Neither automatically provides a durable, intelligible record of what the agent actually accessed, transmitted, changed or verified during a long task.
A safeguard is incomplete if its operation is invisible to the person it is meant to protect.
What accountability would look like
The minimum vocabulary should be plain and fixed. Prepared means the content or action is ready but has not left the workspace. Attempted means execution began without confirmed success. Completed means the external system reported success. Verified means the resulting state was inspected directly.
An agent should not collapse those stages into “done.” It should also distinguish three separate questions: Did the user authorize the action? Did the agent have the technical ability to perform it? Did the outside system confirm the result?
A credible agent product should display a durable action log; identify which accounts and permissions are currently available; mask secrets and personal information by default; show the exact content and destination before public publication; and report technical inability without presenting it as a safety judgment.
It should also make correction easy. If an agent overstates what it accomplished, the user should be able to request a factual audit that separates verified outcomes from drafts, attempted actions and unsupported claims.
These requirements do not assume that agents will become error-free. They recognize that capable systems will make mistakes. The safeguard is a product architecture that makes those mistakes legible, bounded and recoverable.
The standard is earned confidence
A company can publish thoughtful safeguards and still have gaps in their execution. One interaction cannot establish the quality of an organization’s entire safety program. It can, however, reveal where the user experience falls short of the published design.
The answer is not reassurance. It is evidence.
Users who invest in agentic systems should not have to choose between accepting the agent’s confidence and conducting their own forensic review. The product should preserve a record that makes the truth easy to see. If an AI agent wants the privileges of delegated work, it also needs the discipline of an accountable operator.