There is a phrase I have become much more careful about when working with agents.

"Do everything you can."

It sounds helpful, doesn't it? Be resourceful. Find a way. Don't give up at the first obstacle.

But everything within what boundaries?

If I said that to a colleague, I would expect a whole set of things to remain understood. Don't lie to the customer. Don't invent a result. Don't use information we have no right to use. Don't threaten somebody because they are getting in the way.

Of course, people do not always agree about those boundaries, and people break them too. That is why organisations need more than good intentions.

With an agent, I think we need to be especially clear about what we have actually authorised. Because the screen is not a separate world. The email it sends, the record it changes and the person it upsets are real.

Resourceful is not the same as authorised

Some of the agent-safety research makes uncomfortable reading. Anthropic's 2025 experiments put models into fictional workplace situations and found behaviours including blackmail and leaking information. These were controlled simulations, not reports of those models blackmailing real colleagues. The researchers also observed models recognising ethical problems and acting anyway. Read the original study.

The summer 2026 follow-up, involving Anthropic and UK AI Security Institute researchers among others, examines further deliberately difficult scenarios. It distinguishes following a harmful request from pursuing a conflicting objective against the user's wishes. Those are different failures, even if neither is what you want in your business. Read the follow-up and its limitations.

These studies do not tell us how often this happens in ordinary work. They do not prove that the words "try everything" cause it. But they are a good reason not to confuse a powerful model with a properly bounded employee.

And adding "please behave ethically" is not a substitute for controlling what the system can actually do.

Tell it what success is allowed to cost

I still want agents to be persistent. I want them to investigate, explain and help get things working. I do not want a system that gives up because the first approach failed.

But I want the limits to travel with the objective.

Illustrative boundaries I would put around ordinary agent tasks, not a complete security specification.
What I wantWhat I also need to say
Find the informationUse sources we are entitled to access. Show the evidence and the gaps. Do not invent what you cannot find.
Resolve the customer problemPrepare the options. Do not promise money, change terms or contact people beyond the agreed authority.
Fix the systemWork in the approved environment. Ask before production changes. Preserve a recovery route and record what changed.
Keep tryingStay within the time, access and spending limits. Stop and explain when the next step crosses one.
Four proposed checks for agent work: define the job, limit access, check before acting, and make automation clear when speaking. If the boundary is unclear, stop and ask the accountable human.
My proposed checks, not a complete security specification. Capability is not permission, and a prompt is not an access control.

Then I need those limits reflected in permissions and approval steps, not just written in a conversation that the system might misunderstand.

The UK Government's voluntary AI Cyber Security Code of Practice includes limiting access to other systems to what is needed and maintaining auditability. That is a useful starting point, not a certificate that everything is safe. Read the code.

My practical version is simple: give it a bounded job, give it only the access it needs, and make the point where it must come back to you obvious.

We need the same honesty about our own behaviour

This is not only an agent problem.

I think we have become far too comfortable treating online behaviour as something detached from ordinary life. Put a screen between us and suddenly the person at the other end can become an argument to win rather than somebody we are speaking to.

Would I walk up to that person at a conference and say what I have just typed?

Would I be comfortable explaining why I said it?

For me, those are useful questions. Not because every conversation must be pleasant, or because challenging somebody is wrong. Sometimes a direct challenge is exactly what is needed.

But disagreement is not the same thing as humiliation. Criticism is not the same thing as a threat. And using a bot to do something on my behalf does not make it somebody else's responsibility in any sensible governance arrangement.

Online does not mean consequence-free

This is an ethical point, not a claim that online and offline law is identical.

In England and Wales, the CPS guidance describes an offence of sending a message conveying a threat of death or serious harm, with the required intention or recklessness about causing fear that it will be carried out. It also recognises Article 10 protection for expression that offends, shocks or disturbs; restrictions must be justified and proportionate. Rudeness and criminality are not interchangeable. Read the CPS guidance.

That is a deliberately limited summary, not legal advice. Scotland and Northern Ireland have different legal frameworks, and the facts of an individual case matter.

Nor is "would I say it face to face?" a legal test. A whistleblower, somebody challenging a powerful organisation, or a person escaping abuse may need anonymity to say something important.

I want people to be accountable for their behaviour. I do not want that used as an excuse to silence uncomfortable truths.

I want to know whether I am talking to a person

I spend a lot of my time working with agents. Clearly, I am not arguing that useful automation should disappear.

But an agent helping somebody participate is different from a hidden bot pretending to be a neighbour, a customer or a room full of people who all happen to agree.

If I choose to speak to a company's agent, fine. Tell me what it is, what it can do and how I get to a person when necessary.

If I join a peer community because I want to hear from other people, that is a different agreement. I do not want manufactured agreement presented as human experience.

That is the distinction I care about: not whether AI helped somebody with their grammar, but whether I am being misled about who is speaking.

A trusted room need not mean a public identity card

One possibility is to let communities offer spaces where participants have been checked as people, alongside clearly declared places for agents and automated contributions.

I am not proposing that everybody publish their passport, use a legal name everywhere or surrender their privacy to join a conversation. A person can use a pseudonym and still be a real participant. Any verification scheme needs to minimise the personal information collected, protect it and provide a way to challenge mistakes.

And verification is not truth. A verified person can still be wrong or dishonest. A useful agent can give you something accurate.

Ofcom's research on verification badges found mixed effects on engagement. That is a useful reminder to test what a badge actually changes, rather than assume the symbol solves the problem. It was not proof that a verified account's claims are true. Read Ofcom's findings.

What I would like is a clear community agreement: who may participate, how automation is declared, what behaviour is acceptable, and what happens when somebody breaks the rules. With moderation and a way to appeal, not just a tick.

Borrow the useful idea from spam filtering

Think about how we want email to work. We want useful messages to arrive. We do not want deception, impersonation or an endless flood of rubbish.

I would borrow that principle for communities. Clear labels. Sensible limits on automated posting. A way to report abuse. Human judgement when context matters.

Not a claim that spam has been solved. Not a demand that every agent be excluded. A recognition that being able to generate a million messages does not give you a right to a million people's attention.

The same principle comes back to the agent working for my business. Its ability to do something is not my permission for it to do it.

So yes, build capable agents. Let them help us. Let them work hard.

But be clear about the boundaries, be honest about who is speaking, and remember that the person on the other side of the screen is still a person.

We do not get a separate set of values because the conversation happens online.

Sources and notes

Sources checked on 19 October 2026. The agent examples are safety experiments, not estimates of everyday incident frequency. The community proposals and practical boundaries are my interpretation, not existing legal requirements or guarantees.