--- title: "Consent by example" author: Dan Birman url: https://dbirman.com/consent updated: 2026-11-09 summary: "When you hand an agent a rule like “flights under $600, no red-eyes,” you’re signing something you haven’t read, because the agent turns your words into its own policy." --- # Consent by example Agent Trust Patterns · 01 · v1 · Oct 2026 · 4 min When you hand an agent a rule like “flights under $600, no red-eyes,” you’re signing something you haven’t read, because the agent turns your words into its own policy. Instead of asking people to review that policy, show them a few cases right at the edge of it and let them sort. ## The problem Agents now take standing instructions: a budget, a set of brands, a time window. Payment networks can even enforce them. But the instruction is written in your words and executed in the agent’s. “No red-eyes” could mean no flights after 10 pm, or no flights that arrive before 7 am, or nothing overnight. You find out which one it picked when it books the wrong flight. The research is blunt about this: people reviewing a policy written from their own words miss subtle translation errors, and a long policy is too much to check. ## The pattern 1. **Never show the policy first.** Show examples. People are good at judging a specific flight and bad at auditing a rule. 2. **Pick examples at the edges.** A $598 flight that leaves at 5:50 am. A $640 refundable nonstop. The agent should choose the cases where it’s least sure what you meant, not random ones. 3. **Turn every disagreement into a written rule.** If the agent would have booked the 5:50 am flight and you say no, “no departures before 7 am” goes into the mandate, in plain words. 4. **Ask again when the world changes.** New route, new prices, new season: rerun a couple of edge cases instead of trusting an old reading. ## Try it You asked an assistant to book your flight to New York for an offsite: “Under $600, no red-eyes.” Before it books anything, it shows you five flights it isn’t sure about. Sort them and watch the mandate change. [Interactive demo. Switch to the human view to try it.] Made-up flights and prices. ### Try it with your own instruction Type something you’d hand to an agent. Claude writes five things an agent might do with it, each one near the edge of what you meant. Sort them, then see what Claude would have assumed. [Interactive demo. Switch to the human view to try it.] ## Why I care At Uber, the hardest requirement on tipping came from the top: it couldn’t feel obligatory. Everyone agreed with that sentence, and it still didn’t tell us what to build. We only found out what “not obligatory” meant by putting concrete versions in front of people. Asking for a tip before the rating felt transactional. Showing it as part of the receipt made a thank-you look like a bill. Each example made the principle sharper than any amount of discussion did. ## The evidence South and colleagues propose turning natural-language permissions into formal policy for people to review, and name the open problems: translation accuracy, reviewers missing subtle errors, and policies too large to check ([Authenticated Delegation and Authorized AI Agents](https://arxiv.org/abs/2501.09674)). Google’s [Agent Payments Protocol](https://ap2-protocol.org) lets an agent carry signed spending limits, but the person still writes the limits blind. Anthropic found that most risky actions its own safety check missed came down to misjudging whether the user’s consent actually covered the action ([Claude Code auto mode](https://anthropic.com/engineering/claude-code-auto-mode)). ## Closest prior work “Policy as Prompt” attaches examples to guardrails so experts can review them ([Kholkar and Ahuja](https://arxiv.org/html/2509.23994v1)). Shape of AI’s “sample response” previews an output to confirm intent ([Shape of AI](https://www.shapeof.ai/pattern-types/governors)). Neither tests the edges of what a person is authorizing. Programming by example has a long history in security research, but I haven’t found it applied to agent mandates. ## Watch for The examples decide what gets checked. If the agent only shows easy cases, the sorting is theater, so the edge cases have to come from where the agent is least certain. And keep it to a handful: this is a five-second check, not a quiz.