The most honest place to test an agent is the command line. There is no dashboard to hide behind.
Take a routine request. Find every customer whose trial ends this week and draft the renewal email. Three steps. Read the records. Filter by date. Write the draft.
Today this runs through a terminal with whatever permissions the environment happened to grant. Reading one record and reading every record are the same door. The write step that sends words to a customer has no approval pause. The permission decision is invisible. After the fact, the log says the command ran. It says nothing about whether it should have.
A CLI-driven task through a contract layer looks different. Structured reads with field-level scoping, so one record and every record are different doors. The filter runs against typed records, not scraped output. The write step waits for a named human before anything leaves.
The walkthrough is short on purpose. The point is not the commands. It is that every step in the transcript carries its permission decision, visible in the log, auditable after the fact.
When an agent runs a task from your terminal, where is the permission decision recorded. And who approved it.
Top comments (0)