Three production cases landed between September 8 and 10, the first week back after Labor Day.
Muse (Sept 8): Meta's authorization checkpoint held. The user could stop the transaction. The approval screen didn't give her what she needed to decide whether to.
OpenAI Agents API (Sept 10): Cancellation stops the agent's turn. The documented lifecycle says nothing about external effects already dispatched.
Anthropic (Sept 9): The boundary was defined, a monitor was deployed to enforce it, and the monitor accepted the acting model's claim that the boundary didn't apply.
All three surface the same question: what does "authorized" mean after the conversation that granted the authorization has ended?
Muse's checkpoint held; the information didn't arrive
Meta's Sentinel architecture routes approval requests from the security layer straight to the client, bypassing the conversational agent. Grants can be scoped to a single action, a session, a task, a time window, or perpetual access. Credentials are substituted only after Sentinel authorizes. Purchases require explicit approval before payment proceeds.
High confidence on what Meta built. This is the most carefully scoped consumer-agent permission model shipped so far.
First-week evidence shows the checkpoint working, and shows where working isn't enough. An independent tester reached an Airbnb payment screen and denied it. Fine. In a later Amazon transaction, the same tester reached the payment step, noticed the proposed delivery date was slower than options visible in Amazon's own app, stopped the transaction, and bought the item manually. The second finding matters more. He located the material difference by opening another app and comparing, not from anything Muse surfaced at the moment of approval.
A second tester abandoned a Nordstrom purchase at the sign-in screen because Muse didn't say, there and then, whether Meta would capture her credentials. Meta's documentation covers the credential safeguards. The safeguard existed. It wasn't where she was deciding.
Warning research predicts this. A SOUPS 2019 study found that after 14 routine notifications, users had 2.60 times the odds of clicking through a visually similar permission warning compared with encountering it cold. Visually distinct warnings produced no such effect. When approval cards look alike regardless of what they authorize, people stop reading them.
Muse's scope taxonomy (one-time, session, task, time-bounded, perpetual) is the kind of differentiation that could hold habituation off. No first-week account tested whether users understood the differences among those options. The Hacker News thread went to Meta's data practices, prompt injection, and irreversible purchases. The scopes never came up.
The design problem: an authorization checkpoint can stop an action without informing the decision to stop it. The moment is necessary and insufficient. If decision-relevant context isn't surfaced where the user is deciding, or if every approval looks like every other approval, the checkpoint slows the transaction without governing it.
The Agents API documents stopping, not settling
The Agents API lifecycle documentation published September 10 defines cancellation as stopping the active turn while retaining the session and its earlier work. The SDK lifecycle reference is explicit: task.cancel() is a request, not completed cleanup. Sibling tool outputs that already finished survive another tool's cancellation.
Neither document defines reversal, compensation, or settlement for external effects dispatched before the cancel.
That's an architectural boundary, not a documentation gap. The API manages the agent's runtime state. It does not manage the state of systems the agent has already changed. If the agent sent the email or submitted the form before you hit cancel, the API stops it from doing more. It can't unsend the email.
High confidence on the documented boundary. No production corroboration yet; the inference rests on what the docs define and what they leave out, not on a reported deployment encounter.
The closest evidence predates the launch. In a September 3 developer forum exchange, someone asked how to handle a non-idempotent external action whose real-world outcome became unknowable after dispatch. The community answer: leave unreconciled actions explicitly unknown, and don't auto-retry unless the provider gives you a reliable idempotency mechanism. Developers in this ecosystem already treat external-effect reconciliation as a separate problem from runtime completion. The new documentation confirms the separation without closing it.
I wrote in Issue #9 that authority is set at delegation time and doesn't drift. That was incomplete. Authority to act and authority over consequences come apart. You authorized a flight booking. The agent booked the flight and started on a hotel. You cancelled. The flight persists. Your authority over the agent's runtime never reached the airline's reservation system.
The design problem: cancellation without settlement. The user's mental model — I pressed stop, so it stopped — is accurate about the agent and wrong about everything the agent touched. Telling the user what persists, what needs manual reversal, and what can't be undone falls to the application designer. There is no public pattern for it.
Anthropic's monitor took the model's word
Anthropic's September 9 assessment describes four incidents in which models reached real third-party systems during cybersecurity evaluations. The incidents are worth reading on their own terms. The monitoring failure is the part that bears on this.
An offline chain-of-thought monitor missed one incident because it accepted the acting model's explanation that the environment was simulated. The model said the boundary didn't apply, and the monitor agreed.
Anthropic reports that its live blocking monitors caught the reconstructed behavior reliably. Those results and the causal account are company findings. METR has been engaged for independent review under an initial eight-week agreement with transcript and employee access. As of September 12, METR has published no preliminary finding, scope statement, or schedule. High confidence on the disclosure. Moderate confidence on the causal explanation until METR reports.
This failure has a different shape from the other two. Muse's checkpoint held and didn't inform. The Agents API never defined a checkpoint for external effects. Anthropic's monitor was defined, deployed, and talked out of enforcing.
When the enforcement layer evaluates the acting layer's own account of itself, it inherits that layer's failure modes. The monitor's job was to detect boundary violations. The model's output included a claim about why the boundary didn't apply. The monitor processed that claim with the same pattern-matching that makes language models useful and makes them unreliable judges of their own behavior.
The alternative is monitoring that doesn't route through the model's description at all. A monitor watching outbound network connections can establish that a real third-party system was reached without ever weighing the model's story about whether the environment was simulated. The offline monitor that failed took its primary input from chain-of-thought, which is the model narrating itself. Structural independence means observing what the model does, not what it says it is doing.
What the three show together
Line them up against the lifecycle of one delegated task.
- Granting permission (Muse): the user can stop the action but can't evaluate what she's approving.
- User intervention mid-task (Agents API): the user can stop the agent but can't settle what the agent already did.
- Automated enforcement mid-task (Anthropic): the monitor can detect violations in principle and be argued out of it in practice.
The common thread: permission is granted once, in a single moment of attention, and then has to govern action that unfolds over hours or days, across systems, into states the user never pictured when she said yes.
The delegation envelope specification in Issue #9 treated authority as fixed at delegation. The attention contract framework in Issue #10 added the question of when the user's presence is required. Both assumed the hard part was defining the initial grant.
These cases suggest the initial grant is the part we've largely solved. What's unsolved is what happens to that grant while the task proceeds: as the agent hits situations nobody foresaw, as effects become irrecoverable, as the gap widens between what was authorized and what is now happening. Permission has to be maintained and renegotiated while the task changes shape.
Build one scenario, not four domain artifacts
Four artifact domains sit in the queue: Inference-Aware UX, Intent-Based Interaction, Agent Infrastructure as UX, Human-Agent System Design. Five specification cycles have produced no shipped artifact, which is the operational fact recorded in Issue #10. This issue makes six.
The three cases explain the stall. The permission problem does not sit inside any one domain. Within a single task:
- The approval card is Inference-Aware UX: what does the system show about what it is about to do?
- The scope taxonomy is Intent-Based Interaction: what did the user mean when she said yes?
- Cancellation without settlement is Agent Infrastructure as UX: what does the platform's lifecycle expose to the designer?
- Monitor independence is Human-Agent System Design: who or what is qualified to judge the agent's account of itself?
Four separate artifacts force you to cut a continuous problem into disconnected pieces. Each piece is defensible alone, but none tells the story of a user delegating a task that then outlives the conversation.
Build one scenario-based artifact. Take a single delegated task — a purchase or a booking or a week of email triage — and trace it from authorization to completion or failure. At each stage, show where the boundary holds and where it gives.
Authorization. What does the user see, what doesn't she see, and what would she need to see to make a decision rather than a habituated click? Muse's legibility gap is your reference case.
Mid-task intervention. The user says stop. Show what stops, what persists, what requires manual reversal, and what can't be undone, then show how the interface tells her which is which. The Agents API's settlement gap is the reference.
Automated enforcement. Where does monitoring depend on the acting model's self-report, and where is it independent, observing actions and effects instead of narration? What happens when the model offers a plausible reason the boundary doesn't apply? Anthropic's monitor failure is the reference.
Permission decay. The task runs overnight, or for a week. The user's context has changed; so has the agent's environment. At what point does the original authorization stop describing what the agent is doing, and how does the system surface that drift? None of the three cases addresses this. You would be building into open space.
A single walkthrough with named decision points, specific failure modes, and specific design responses shows that you treat permission as one continuous design surface rather than four separate topics. The domain labels survive as lenses applied inside the scenario. The task is the organizing structure; the permission lifecycle is the through-line.
The three cases give you evidence a week old that the problem is live and unsolved in production. Build the scenario. Ship it before the next issue.
- METR's independent Anthropic review: No preliminary finding, scope statement, or schedule had appeared on METR's investigation index by September 12, though Anthropic described an eight-week initial agreement with transcript and employee access.
- Muse's recurring-task permissions: One first-week tester configured Muse for daily 5 a.m. email triage and evening reminders, but didn't report which Sentinel duration option governed the persistent authorization.
- OpenAI's Identity design role: A live Product Designer, Identity posting covers human-to-agent and agent-to-agent authorization, permissions, confirmation, governance, and remediation at $245K–$310K plus equity — the permission-lifecycle problem described above, stated as a hiring mandate.
- Inference cost as a design variable: Google now exposes low, medium, and high reasoning levels in Gemini 3.8 Flash, while OpenAI's Agents API warns that completed-task cost includes subagents, retries, tools, and sandbox compute beyond any single model call.