[Ed. Note: This is part of an ongoing series at The Geek in Review Substack page. – GL]
Leo Huang did not usually come to the twelfth floor, and he never came to it at seven-forty in the morning. So when Cooper looked up from his coffee and found him in the doorway, still in yesterday’s shirt with a laptop held against his chest like a clipboard, he could tell something was going on, and from the look on Leo’s face, probably something bad.
“I think we almost sent a client something we shouldn’t have,” Leo said. “I think the intake agent cleared it, and I think it’s been clearing things it shouldn’t for a while, and I can’t find anyone whose job it is to care.”
Cooper put the coffee down. “Sit. Start at the beginning, slowly. What got cleared.”
Leo set the laptop on the desk and turned it. On the screen was the intake queue, the one the business-intake team and the junior associates worked off of every morning, the inbound non-disclosure agreements and engagement requests that the firm’s intake agent read overnight, classified by risk, and stacked into three colors. Green for standard, clear to send. Yellow for a human look. Red for a partner. The agent drafted the first-pass response too, so that by the time a person opened the item, there was already a reply sitting under it, polite and competent and ready to go out.
“This one came in Monday,” Leo said, and opened it. “Counterparty NDA, mutual, looks like every other one. The agent tagged it green. Standard, clear to send. The response was already drafted. Someone on intake would have sent it this morning, today, because that’s what you do with green, you send it.” He scrolled. “But I was staffed on the underlying matter, so I actually read the thing. And buried in the confidentiality section there’s a non-solicit. Twelve months, their employees and ours. That’s not a confidentiality term. That’s a restrictive covenant riding inside an NDA, and we have a house rule that any embedded non-solicit goes to a partner, because Maya made it a rule after that mess last year.”
“And the agent missed it.”
“The agent didn’t miss it. That’s the part that kept me up. It saw the non-solicit. It just decided it was boilerplate. Because the playbook it’s reading still says standalone non-solicits in NDAs are standard market and don’t need escalation. Which was true. Last spring. Before the rule changed.”
Cooper felt the morning go quiet around him.
“So I went looking for the playbook it’s reading,” Leo said. “It’s pointed at a document in the old KM folder. The one we superseded in March. The current house position, the one with the non-solicit rule, lives in a different place now, and nobody ever told the agent. It’s been reading a dead document with total confidence since the spring. Every green tag it’s handed out since March, it handed out from a rulebook we threw away.”
“How many is that.”
“I don’t know. That’s the other thing.” Leo looked at him. “I went to find out who owns this agent so I could tell them. There’s no one. It was a pilot. I built the clause-extraction piece, the part that pulls terms out, eighteen months ago, but I don’t own the thing it became. Somebody in KM stood up the production version, and somebody used to check it on Fridays, and I went and asked, and the person who checked it moved to the Houston office in the spring. The Friday review went with her. Except it didn’t go anywhere. It just stopped.”
Cooper was already standing, already reaching for the marker he kept by the door.
“Don’t send anything green until I get back to you,” he said. “I’m getting the room.”
• • •
He got the room by ten. Not the firefighting version from the Friday in June when a government had reached across an ocean and switched off a model while everyone watched from their kitchens. The deliberate one, Governance Committee on twelve, door closed, three hours blocked. Nora came up from the administrative floor with her iPad and the look of someone who already suspected she would not enjoy the next three hours. Maya came in between a deposition and a closing, reading glasses pushed into her hair. Jesse joined from his lab in Chicago, a window on the wall screen with whiteboards behind him. And Arthur joined the way he joined everything now, a calm rectangle in the corner, the leather spines of his home study at his back.
Cooper wrote one sentence on the board, not a phrase this time but a full sentence, and stepped away so they could all read it.
“That’s not mine,” he said. “It’s been going around. There’s a briefing the partners have all been forwarding each other since the weekend, about teams running agents that nobody owns. I read it twice and then Leo walked into my office this morning and handed me the live version of it.” He told them the NDA. The non-solicit riding inside the confidentiality section. The green tag. The drafted reply that would have gone out today. The playbook the agent had been reading since March, the one the firm had superseded and the agent had never been told about.
“For most of June,” he said, “we were worried about the wrong direction. The Thirty-Day problem, the Friday a model disappeared, the half-billion-dollar headline, the Chinese weights. All of it was about intelligence we rent from outside, and whether it would still be there, and whose hand was near the switch. Every one of those was about something coming at us from the outside. This is the opposite. This came from inside the building. This is an agent we built, that works, that everyone trusts, quietly handing out wrong answers from a rulebook we threw away in the spring, and the reason nobody caught it is that nobody’s job was to catch it.”
“We called last week’s problem the ownership problem,” Maya said. “Owning the model versus renting it.”
“Different word, same week, I know. That ownership was about whose balance sheet the intelligence sits on. This one’s smaller and closer. It’s about who’s responsible for one agent doing one job, today, correctly. Owning the model is a strategy question. Owning the agent is a Tuesday question. We’ve been answering the first one all month and we never asked the second.”
• • •
Jesse had his hand half up in the video window, the old classroom reflex.
“Can I do the part that’s going to feel like a coincidence and isn’t,” he said. “Because the machines already solved the thing you’re describing, for themselves, and watching them solve it is the fastest way to see what you’re missing.”
“Go.”
“When two of these agents need to work together, one has to know what the other is and how to talk to it. So there’s a standard for that now. Google put out a protocol, agent-to-agent, and the heart of it is a thing called an Agent Card. It’s a small file, published at a predictable address, slash dot-well-known slash agent dot json, and it says, in plain machine-readable terms, here is what I am. Here’s my name. Here are the skills I offer. Here’s the kind of input I take and the kind of output I give back. Here’s how you authenticate to me. Another agent reads that card and knows exactly how to delegate work to the first one, or knows not to.” He paused. “Anthropic’s protocol, the one we already use, the Model Context Protocol, does the same thing one layer down for tools. A server publishes a machine-readable description of what it can do, so an agent can discover it. The whole ecosystem now runs on the principle that nothing autonomous should be a black box to the things that depend on it. Every agent hands out a card that says who it is.”
Cooper saw it. “And the humans don’t have one.”
“The humans don’t have one. Your intake agent could publish a perfect Agent Card tomorrow. It could tell another machine exactly what it does and how to call it. What it cannot tell anyone is who at this firm is responsible for it, what it’s reading, whether what it’s reading is current, and the last time a human looked at its work. The machines built themselves identity documents so they could trust each other. We never built the human version. The briefing’s whole idea, the thing it calls an Agent Owner’s Card, is just that. The card the machines already give each other, rewritten for the person who has to answer for the agent.”
“So the gap isn’t technical,” Nora said.
“The gap is the opposite of technical. The machine half is solved. The card the agent hands another agent is solved. What’s missing is the card a human holds. And you can’t generate that one out of the model, because most of what goes on it is a decision only a person can make.”
• • •
Nora had been waiting with the patience of someone who knew the arithmetic was coming to her, and she put the intake agent’s dashboard on the wall screen.
“Before anyone decides this agent is broken, look at how healthy it is,” she said. “Volume is up forty percent since the pilot. Average turnaround on an inbound NDA went from two days to under four hours. Error rate, by every flag we log, is zero. If you ran this agent’s numbers in a board deck, it would be the best-performing thing the firm operates. Green across the board. And it has been handing out wrong classifications for three months.”
She let that sit.
“That’s the part I want everyone in this room to feel, because it is the dangerous part. Nothing on this dashboard is lying. The agent is fast. It is consistent. It does not crash. It does not throw an error, because from its own point of view it is not making one. It is applying the rulebook it was given, perfectly, to every document, on time. It is operationally flawless and behaviorally wrong, and there is no metric on this screen that can tell the difference between those two things. The only thing that could tell the difference is a person reading the output against the current rule. And we stopped doing that in the spring.”
“Walk the failure,” Cooper said. “All of it. Leo found the first piece. What’s underneath.”
Nora moved through it the way she moved through everything, one row at a time.
“Three failures, and they stack. The first is the one Leo found. The source it reads is stale. It’s pointed at a playbook we superseded in March, so its facts are three months out of date and it cites them with full confidence. Fix the pointer and you fix today’s NDA. You do not fix the other two.
“The second is the brief. The agent’s standing instructions, the prompt that tells it how to behave, were written fourteen months ago for the pilot. They still say to treat the old standard as the default. And on top of that they’ve silted up. Every example we ever fed it during the pilot is still in there, dozens of sample contracts that no longer match our house style, all of it still sitting in the agent’s context competing for attention with the instructions that matter. It isn’t failing because it knows too little. It’s failing because it’s carrying fourteen months of accumulated junk and can’t tell what still counts.
“The third is the one that should bother us most, because it’s the one that let the other two survive. Nobody is reading the output. When the agent was new, the KM associate who stood it up sampled it every Friday. She moved to Houston in the spring, and the review didn’t transfer to anyone. It simply ended. The field on my screen for last human review is blank. Not old. Blank. We have an agent the whole intake team trusts on sight, and the last time a human actually checked whether that trust was earned, I can’t give you a date.”
She looked up from the iPad.
“And while I have the floor. This is one agent, the one Leo happened to be staffed against. I run six workflows on the administrative floor right now that look exactly like this from the dashboard. Green, fast, unattended. I am not telling you any of them are wrong. I’m telling you I don’t currently have a person I could name for most of them either. We have been very proud of how many of these we’re running. We have not once counted how many of them anyone owns.”
The room was quiet. Cooper wrote, on the side of the board, operationally flawless, behaviorally wrong, and under it, smaller, the blank field is the finding.
• • •
Maya took the glasses out of her hair and folded them, which was how Cooper knew she was about to say the thing that mattered.
“I want to name who owns this one, because the answer tells you the whole principle,” she said. “It is not Leo. Leo built a part of it and Leo is the reason we’re not sending a defective NDA this morning, but Leo is a second-year, and the agent’s mistakes don’t land on his desk. It is not KM, who stood up the production version. It is not IT, who keep it running. It is not this committee. The owner of that intake agent is whichever partner would have to call the client and explain why we let a twelve-month non-solicit go out under our name as standard market. That’s me, on this matter. The owner is the person who eats the consequence.”
“Ownership follows the consequence, not the keyboard,” Cooper said.
“Ownership follows the consequence. The person who wrote the prompt can tell you what the agent was supposed to do. Only the person on the hook for the outcome will actually notice, and care, when it stops doing it. That’s why you can’t hand this to the people who built it and call it owned. They’re not the ones who get the phone call.” She put the glasses down on the table. “And here’s the part that makes it hard, the part the briefing got right. A good agent’s entire purpose is to earn the right not to be checked. We want intake to trust it on sight. That’s the win. That’s why we built it. And trust-on-sight is the exact thing that removes the person who would have caught the drift. The better this agent gets, the more dangerous it becomes, because the reward for being good is that everyone stops looking. We’ve seen this movie. We called it verification drift two weeks ago when it was about lawyers getting lazy with a first draft. This is the same disease one level up. It’s the firm getting lazy with an entire agent.”
“So the answer can’t be to trust it less,” Nora said. “The whole point is to trust it.”
“The answer is that somebody has to be assigned to keep looking precisely after everyone else has earned the right to stop. On purpose. As a job. Not because they distrust it. Because they own it.”
• • •
Cooper went to the clean half of the board.
“Then let me build the human version of Jesse’s card, out loud, for this agent, so we can see what it costs us to actually know what we’re running.”
He didn’t draw boxes. He talked it onto the board the way Maya talked her diagrams onto a page, a field at a time, and the room filled in the answers as he went.
It would start with identity, he said, the easy part, the part the machine could write itself. What the agent does, in one sentence. Reads inbound NDAs, classifies risk, drafts the first response. Then the part the machine couldn’t write. The owner. One name. The partner who eats the consequence, which this morning meant Maya. A backup, for when the owner was in a closing or on a plane, because an agent whose only owner is unreachable for three weeks in August is an ownerless agent for three weeks in August.
Then scope, he said, and this was where it stopped being comfortable. Who actually acts on the output, and do they re-check it or trust it on sight. For the intake agent the honest answer was that the whole intake team trusted it on sight, which was the win and the exposure in the same line. And reach. What real systems it touched, what it could set in motion if it went wrong. An agent that drafts a reply a human sends is one blast radius. An agent that sends the reply itself is another. You wrote down the blast radius so you knew how hard to hold the thing.
Then the inputs, he said, and looked at Leo. What source material it depends on, and when somebody last confirmed that source was current, and who that somebody is. The blank where the freshness date should be was the whole reason they were in the room. Then the brief. Where the agent’s standing instructions live and when they were last reviewed, because a fourteen-month-old prompt was its own kind of stale source.
And then the last block, he said, the one that mattered most because it was the one that had failed silently. The review loop. How often, and by whom, the output gets sampled. The actual date it last happened. And a line for the condition that would make the owner pull the agent offline, and who was allowed to pull it. He underlined the date field twice.
“That field,” he said, “the last-reviewed date. On this agent it’s blank. That blank is not missing data. That blank is the finding. A card where ‘owner’ is empty means you’ve found an agent nobody owns. A card where ‘last reviewed’ is three months old on an agent the whole team trusts on sight means you’ve found a dead review loop before it cost you a client. The empty fields are the entire value of the exercise. You don’t fill the card out to look organized. You fill it out so the holes show you where you’re already exposed.”
Jesse, from Chicago, said it plainly. “That’s the card my agents already hand each other. You just wrote the half that has a person’s name on it.”
• • •
Cooper looked to the corner of the screen. “Arthur. You’ve gone quiet on us.”
Arthur set down his pen. The small sound of it carried over the link, and the table came to rest around it, the way water settles.
“I have been listening for the line this committee keeps blurring, because the blur is the most dangerous thing in the room, and I have watched it blur twice this month,” he said. “Let me draw it clean.”
He let it settle.
“What we wrote down in March, the framework, the access controls, the question we now ask every vendor before we sign, that is governance. Governance is the road. It sets the rules everyone drives by. What an agent may touch, what gets logged, what is forbidden, what requires a partner. A committee writes the road, and a committee should, and we have, and it scales across the whole firm, and it is necessary. None of what I am about to say is an argument against it.
“But a road does not drive the car. What failed this week was not the road. The rules were fine. The failure was that one particular car had been traveling that road for three months with no one behind the wheel, and the road cannot tell you that. Governance can prohibit a thing and still have no idea whether a permitted thing is being done well, by whom, or whether it stopped being done well in March. That is what ownership is. Ownership is one named person who reads what this agent produces and acts when it drifts. A committee cannot do that, because a committee does not read the output. Twelve people sharing the watch is twelve people each assuming one of the other eleven has it. That is not oversight. It is the absence of oversight wearing the costume of a meeting.”
“Governance without an owner,” Cooper said.
“Is theater. Well-intentioned, well-documented theater. It can prevent some bad outcomes, and it cannot tell you why a good outcome was permitted, or trace what went wrong when something fails, because there is no one standing close enough to the work to know. We have spent the month being careful about the road. The car still needs a driver, and the driver has to have a name, and the name cannot be the committee’s.” He paused. “Leo did the committee’s job this morning, by the way. Not because it was assigned to him. Because he happened to be close enough to the work to see it. We do not get to rely on happening to be close. That is the whole point.”
• • •
“Decisions,” Cooper said, and capped and uncapped the marker the way he did when he wanted them short.
“One. We run the test on everything that’s already running. Every agent in production, practice side and administrative side, gets the one question put to it. Does anyone act on this agent’s output without re-checking it. Every place the answer is yes is an agent that needs a named owner, and it needs one this week, not after we form a working group to think about it.”
“Two. Every owned agent gets the card. Not the machine’s Agent Card, the human one. Name, owner, backup, who consumes it and whether they trust it on sight, what it reaches, what it reads and how fresh that is, where its brief lives and when it was last reviewed, the review cadence, the kill condition. The human counterpart to the file the machines already publish to each other. We are the only ones in the loop without an identity document. We fix that.”
“I can have the agents draft their own cards by Friday,” Jesse said from the screen. “Descriptive fields filled in from what each one can see about itself, and the owner line and the dates left deliberately empty. The blanks come back to you as the worklist. The machine writes the half it can observe. It can’t sign the half that has a person’s name on it, and it shouldn’t try.”
“Three. The blank field is a finding, and we treat it like one. A blank owner or a blank last-reviewed date doesn’t sit quietly on a card. It goes in the risk register as an open item with a name attached to closing it. We were excellent this month at registering risks about models we rent. This is a risk about agents we built, and it gets the same ink.”
“Four.” He looked at Maya. “Ownership follows the consequence, not the keyboard. The owner of an agent is the person accountable for the outcome it produces, not the person who wrote its prompt and not the department that keeps it running. If we cannot name a person who eats the consequence, the agent should not be trusted on sight by anyone, and that is not a punishment, it’s a definition.”
“Five. The review loop is a scheduled job, not a good intention.” He glanced at Nora. “Whoever owns an agent runs a standing review of it on a cadence, monthly as the default, tighter for anything with a large blast radius, and the review checks the three things that failed here. Is the source still current. Has the brief drifted or bloated. When did a human last actually read the output. The failure this week depended entirely on nobody looking. We make looking a job with a date on it, so it can’t quietly end when someone moves to Houston.”
He held the marker out toward the screen. “Six is yours, Arthur.”
Arthur’s tile was still for a moment.
“Six is the sentence the partners will keep, so make it the true one. We are not safer because we run more agents. We are safer when each one has a name attached to it. The committee writes the rules of the road, and that is real work, and we have done it. But every car on that road needs one person behind the wheel who will notice when it drifts and is allowed to stop it. An agent with no owner does not announce itself by crashing. It keeps running, beautifully, on trust it earned under conditions that stopped being true in the spring, and the value drains out of it so slowly that the dashboard stays green the whole way down. The work this week is not technical. It is the oldest work we do. Putting a name next to a responsibility, and meaning it.”
Maya was writing. Cooper could hear the pen.
• • •
They broke a little after one. Nora went down to start the count, agent by agent, on the administrative floor, the look on her face that of someone who already knew the first column would have more blanks than names. Maya went to her closing, but not before she’d written ownership follows the consequence on the back of her own hand, which Cooper had never seen her do. Jesse’s window blinked out, already muttering about how to make an agent leave its own owner field empty on purpose. Arthur’s tile closed with a small nod.
Cooper didn’t stay on twelve. He took the elevator the other way, down to where the morning had started, and found Leo at his desk with the intake queue still open and the green NDA still flagged where he’d left it at dawn.
“Hold the queue until we’ve repointed it at the current playbook,” Cooper said. “Then you can release the rest. The non-solicit one goes to Maya, with your note attached, and your name on the note.”
Leo nodded, then said the thing he’d plainly been carrying since seven-forty. “I only caught it because I was on the matter. If I’d been staffed somewhere else this week, it goes out and nobody ever knows. That isn’t a control. That’s me getting lucky on a Tuesday.”
“No. It isn’t a control.” Cooper pulled a chair around. “That’s the finding, said out loud. So here’s the first card, and we fill it out together, because you know this agent better than anyone who was in that room. We’re not writing it to look tidy. We’re writing it so the holes show. And the first hole has your fingerprints on it, because when you went looking for who owns this thing, you came back with nobody.”
Leo opened a blank document and typed the agent’s name across the top. Under it he set the cursor on the line for the owner, the line he hadn’t been able to fill at dawn, and left it empty, and turned the screen a few degrees so Cooper could see the blank sitting there. Neither of them filled it. The blank was the point. It was a question with a person’s name as its only possible answer, and that name was a decision the firm still had to make on purpose.
Cooper rode back up but stopped at the window at the end of the twelfth-floor hall instead of going into the committee room, and took out the notebook, the same one.
An agent nobody owns doesn’t crash. It keeps running on trust it earned under conditions that no longer hold, and the value drains out so quietly the dashboard stays green the whole way down. Autonomy without an owner isn’t independence. It’s abandonment with good uptime.
He thought about the empty line glowing on Leo’s screen two floors down, and wrote the second.
The machines gave each other a card that says who they are. We never wrote the one that says who answers for them. The empty line isn’t missing information. It’s the haunted house — the lights still on, the work still moving, and nobody home to notice the room went wrong in the spring.
Outside, the early dark had come on and the city had stood up in it, whole floors of the towers lit against the evening over desks that had emptied hours ago. He used to read that skyline as proof the work was getting done. He stood there a while longer than he meant to, counting windows, wondering building by building how many of those burning lights had a name behind them, and how many were only still on.