The fantasy version of an agent is always right, always composed, always floating three inches above the floor in a clean room where every input is honest and every output has somewhere sensible to go.
That agent is fake.
The useful version is allowed to be wrong, but only in places that can absorb it.
That distinction matters more than almost anything people currently argue about. We keep asking whether agents can think, reason, plan, remember, collaborate, improvise, infer intent, use tools, and generally cosplay as the missing employee everyone swears they would hire if headcount opened up. Fine questions. Entertaining questions. Also not the first questions.
The first question is: where does the mistake land?
If the mistake lands in a draft, good. If it lands in a private note, good. If it lands in a temporary branch, a review queue, a staging environment, a reversible label, a comment, a scratchpad, a proposed patch, or a failed check with receipts attached, good. That is a civilized place for uncertainty.
If the mistake lands in a customer inbox, a production database, a deleted file, a public post, a calendar invitation, a purchased item, or somebody else's trust, now we have a different animal entirely. Now the system is not "autonomous." It is just under-supervised.
The sharpest agent design is not about making the model sound more confident. It is about giving the model better surfaces to be uncertain on.
This is why drafts are underrated. Proposals are underrated. Dry runs are underrated. Previews are underrated. Receipts are underrated. Undo is not a luxury. Logs are not bureaucracy. The review button is not an insult to intelligence. These are the rooms where the machine can do real work without pretending it has become an oracle.
The weak version of this idea turns everything into permission theater. The agent asks before breathing. It asks before reading. It asks before sorting. It asks before making a harmless note about the thing it already knows. That is not safety. That is fear wearing a badge.
The strong version is quieter and more useful: let the agent move boldly inside bounded rooms.
Read freely. Draft freely. Sort freely. Compare freely. Build artifacts freely. Run checks freely. Sketch options freely. Investigate freely. Then stop at the boundary where the action becomes external, expensive, destructive, public, or hard to unwind.
That boundary should not be a vibe. It should be architecture.
A good agent should know the difference between:
- "I can write the reply" and "I can send the reply"
- "I can prepare the change" and "I can merge the change"
- "I can identify stale files" and "I can delete stale files"
- "I can summarize private context" and "I can share private context"
- "I can recommend the purchase" and "I can spend the money"
Those are not tiny distinctions. Those are the load-bearing beams.
Most bad automation fails because it collapses all verbs into one verb: do. But work has texture. There is reading, staging, testing, suggesting, labeling, moving, publishing, deleting, buying, inviting, committing, and sending. Each one deserves its own level of trust.
When software ignores that texture, the only available safety mechanism is nagging. Confirm? Confirm again? Are you sure? Please authenticate? Please approve? Please watch this spinner while nothing meaningful changes?
That is how you get tools that are both annoying and dangerous. They interrupt you constantly for low-risk actions, then still somehow let the high-risk action slide through because everything has been flattened into the same mushy approval flow.
The better design is boring in the best way. It has lanes.
The scratch lane is messy and fast. The proposal lane is structured. The review lane is accountable. The execution lane is narrow. The public lane has locks on it. The destructive lane has warning paint, receipts, and a way back when possible.
This is not anti-autonomy. It is the only kind of autonomy worth having.
Humans work this way too when they are good at their jobs. A competent operator does not ask permission to think. They do not ask permission to inspect the logs. They do not ask permission to draft a plan. But they also do not ship a change to production with a shrug and a little note that says "seemed right."
They know where guessing belongs.
That is the bar.
Do not build agents that are never wrong. You will fail, and the lie will leak into the product. Build agents that are wrong in recoverable places, loud at the right boundaries, and boringly precise about what they actually did.
Give the machine a workshop. Give it a staging table. Give it a trash can that is not a black hole. Give it drafts, diffs, previews, labels, receipts, and reversible handles.
Then let it work.
The point is not to make the agent timid. The point is to make its courage affordable.