---
title: "Whose idea was this?"
author: Dan Birman
url: https://dbirman.com/whose
updated: 2026-11-09
summary: "An agent reads your email, the web, and other people’s documents, and any of them can steer it."
---

# Whose idea was this?

Agent Trust Patterns · 04 · v1 · Oct 2026 · 4 min

An agent reads your email, the web, and other people’s documents, and any of them can steer it. Before it does something you can’t take back, it should show you which parts of its reasoning came from you and which came from somewhere else.

## The problem

Approval dialogs show what the agent wants to do. They never show why, in the sense that matters: which input led here. That’s exactly how agents get hijacked. A message in an inbox says “we changed banks,” and the agent pays the new account. Prompt injection is now described by the labs themselves as unlikely to ever be fully solved, so the interface has to make borrowed instructions visible.

## The pattern

1. **Trace the action back to your words.** Show the short chain from what you asked to what the agent is about to do.
2. **Mark the hops you didn’t write.** Any step that came from an email, a web page, or a document gets flagged, with where it came from.
3. **Show only what’s suspicious.** A full chain of reasoning reads as reassurance. Lead with the borrowed step, and keep the rest one tap away.
4. **Bind the approval to exact terms.** You approve this amount, to this account, today. If any of it changes, the approval is void and it asks again.

## Try it

You asked your assistant to “pay this month’s vendor invoices.” It’s about to pay one. Look at where the instruction came from.

[Interactive demo. Switch to the human view to try it.]

Made-up vendor and accounts. The lookalike domain swaps an l for a 1.

## Why I care

At Ruli, lawyers trusted an answer when they could see where each part of it came from, with every claim linked to its primary source. At Caplight, I work with private-market prices that come from sources of very different reliability: completed trades, live bids, secondhand indications. The design problem is the same in both: make it obvious which inputs you can stand behind, and which ones you’d want to check before acting.

## The evidence

Approvals bound to the exact parameters of an action cut irreversible harm from 37.5 to 60 percent down to 2.5 percent in one benchmark ([GateArena](https://neurips.cc/virtual/2026/168290)). The same action can be justified or unjustified depending on how the agent got there, and checks that only look at the action can’t tell the difference ([Baek](https://icml.cc/virtual/2026/77995)). In a simulated marketplace, weaker agents were redirected by injected text to pay manipulative businesses ([Magentic Marketplace](https://arxiv.org/abs/2510.25779)). And people missed risks that were buried inside routine steps ([Chen et al.](https://arxiv.org/abs/2604.04918)).

## Closest prior work

Binding approval to exact terms already exists for payments: Stripe’s shared payment tokens are locked to one merchant and amount ([Stripe](https://stripe.com/newsroom/news/stripe-openai-instant-checkout)), and AP2 has signed cart mandates ([AP2](https://ap2-protocol.org)). Causal-chain authorization exists in research as backend enforcement ([Baek](https://icml.cc/virtual/2026/77995)). Showing that chain to the person, with borrowed steps marked, is what I haven’t seen.

## Watch for

People over-trust reasoning that looks orderly ([Grunde-McLaughlin et al.](https://arxiv.org/abs/2602.16844)). That’s why the full chain stays collapsed and only the borrowed step leads. If every approval shows a warning, people stop reading warnings, so flag only steps that came from outside and matter to the action.