Agents as Proposers

The important architectural question is not whether an agent is trustworthy in the abstract. It is whether the system gives any consumer the ability to impose a state change without the responsible capability making a decision.

An agent should be treated in the same way as every other consumer. It can observe context, form an intention, gather evidence and submit a proposed action. It does not become the authority that validates and executes the resulting transition.

The same rule for every caller

A user interface should not close an issue merely because a button was pressed. An integration should not change a credit limit merely because it holds a valid connection. An automation should not revoke access merely because a timer fired. Each consumer proposes an action to the capability that owns the decision.

The point is not to make agents less useful. It makes their usefulness safer to apply. An agent can work across much broader context than a conventional UI, prepare better evidence, explain its recommendation and retry a recoverable rejection with new information. The authority still decides against current state, policy and permissions.

This also keeps delegated identity meaningful. A request may be made by an agent on behalf of a person, or by an integration acting under a defined service authority. The system needs to know both the immediate caller and the authority under which the action is proposed. Treating the agent’s identity as a substitute for the human or business authority behind it loses that distinction.

A useful boundary, not a bottleneck

The decision boundary should be explicit enough that a caller can discover what it may ask for and what a rejection means. That is why capability contracts describe behaviour, not just payloads, and why governed actions return structured outcomes.

The model gives agents room to reason and act without asking them to become systems of record. They can propose freely. The system remains responsible for acting deterministically.