Tag: agentic AI

  • Your Next Assistant Doesn’t Live in a Chat Window

    Your Next Assistant Doesn’t Live in a Chat Window

    Garage Sale Gadgets · Episode 0

    The series where cheap, forgotten hardware becomes somebody’s AI assistant. Your junk drawer is a fleet.

    A pink Nintendo DS Lite running a pixel-art home assistant called Dash
    Concept art: a 2011 handheld running a real assistant. AI-generated illustration.

    On October 3, a developer named David Ruiz posted a 19-second video that made Alexandr Wang swear. “no fucking way,” Wang quote-posted. “muse gadget on Nintendo 3DS.”

    What Ruiz built: a homebrew game running on actual Nintendo 3DS hardware — a 2011 handheld — where you walk around a pixel-art version of your house and talk to an in-game assistant called Dash. In the clip, he asks Dash if the 3D printer is done. Dash thinks, then answers. The game isn’t pretending to control his smart home. It actually does.

    Your first reaction might be that this is stupid. A game on a fifteen-year-old handheld to check a 3D printer? Fair. Mine was too, for about ten seconds.

    Then the pattern lands, and it’s big: an AI agent, embodied in a game world, running on weak old hardware, acting on the real world. The demo is a toy. The pattern is a platform shift.

    Chat won the first round. Worlds win the next one.

    Every AI assistant you’ve ever used lives in a rectangle with a text box. That was the right interface for 2023. But watch what Ruiz did: he didn’t build a better chatbot. He put the assistant inside a world — a little room with wooden floors, a kitchen, a dog — and gave you a character to talk to instead of a prompt box.

    The room in the game mirrors his real home. That’s the tell. The game world is a digital twin, and the assistant is its voice. You don’t open an app and navigate menus; you walk up to the little guy and ask.

    If it runs on a 3DS, it runs on everything.

    This is the part Wang reacted to, and it’s the most underrated part. The Nintendo 3DS is ancient, underpowered hardware. If a Muse gadget runs there, the hardware constraint is gone. That means:

    • Every old tablet, e-ink frame, car dashboard, and kiosk becomes an agent surface. Your junk drawer is a fleet.
    • Agents can run locally, on-device — faster, private, and still working when the internet dies.
    • Nostalgia becomes an adoption cheat code. People will try AI on a 3DS who would never open a chatbot.

    The crossovers nobody’s talking about yet.

    Follow the pattern out and it stops looking like a gaming story:

    1. Digital twins you can walk through. A facility manager strolls a pixel version of their building, asks the assistant about the HVAC on floor three, and dispatches a real work order — all inside the game. The twin stops being a dashboard and becomes a place.
    2. NPCs that do real work. Game characters that aren’t scripted but genuinely useful — a shopkeeper that orders your groceries, a concierge that manages your calendar while you play.
    3. The Tamagotchi that runs your house. A gamified smart home for everyone intimidated by apps — kids, grandparents. You don’t configure automations; you talk to the little guy in the room.
    4. E-waste as a distribution channel. Millions of abandoned devices become agent terminals. The hardware’s already built and sitting in drawers.
    5. Gadgets as the app store for agents. “Muse gadget” is the tell in Wang’s post. The game is just a host. Any developer can build a gadget for any surface — and that marketplace is the real product.

    The honest caveats.

    The facts here are thin: one demo, one quote-post, no follow-up detail from Wang. This is analysis, not reporting — a forecast, labeled as one. The demo could stay a novelty. Platforms have died on cuter ideas.

    But here’s the thing about platform shifts: they always start looking stupid. The first iPhone apps were fart apps. The first people to put a chatbot in a game room on a dead handheld are the ones who see where the puck is going.

    The forecast.

    Chat was the interface that taught the world to talk to machines. The next interface won’t be a better chat window — it’ll be a world you step into, with an assistant standing in it, ready to act on the real one. Ruiz just showed us the rough draft, running on a toy from 2011.

    Someone’s going to build the polished version. The only question is who gets there first.

    Field notes: the first hunt

    Here’s the fun part: the hardware for this future is already sitting on Facebook Marketplace, priced like garbage. Our daily sweep turned up this morning’s haul:

    • Nintendo 3DS XL — FREE, like new, Atlanta (listing)
    • Nintendo 3DS XL — $1, good, North Lauderdale FL (listing)
    • 3 “new” 3DS XLs — $1, like new, Hopewell Junction NY (listing)
    • Pre-modded 3DS, 482 games — $20, like new, Miami (listing)
    • 3 Fire tablets as a lot — $1, listed new, Littleton CO (listing)
    • Raspberry Pi Pico 2 — FREE, like new, Lockport IL (listing) — two from one seller

    Fair warning: $1-and-free listings are often bait or mispriced. Nothing here is verified. The hunt is half the show.

    Next in the series: we pick a gadget, buy the thing, and turn it into something that talks back. The Junk Drawer Fleet assembles one garage sale at a time.

  • I Watched My AI Agent Work. I Couldn’t Tell What It Was Doing.

    I Watched My AI Agent Work. I Couldn’t Tell What It Was Doing.

    I had an AI agent doing something routine in a browser today — opening a server terminal, placing a small text file. Nothing exotic. While it worked, I opened the activity feed to watch.

    This is what I saw:

    Cropped screenshot of an AI browser agent's activity feed showing four entries labeled only with internal element IDs: Clicked element @e51, @e46, @e212, @e224.
    Four entries, cropped from the feed. Every one is an internal element ID.

    “Clicked element @e51.” “Executed click on element @e21.” “Clicked element @e224.”

    I had no idea what any of it meant.

    Here’s what I kept thinking while I stared at it: I’m watching this thing click around inside my infrastructure, and I can’t tell the difference between “everything is fine” and “it just did something terrible.” For all I knew from that feed, it could have pressed the button that drains all my money. The log was written for the machine, not for me.

    I didn’t want to interrupt. The agent was in the middle of working, and I didn’t want to be the guy hovering over the desk. So I went to look at what it was doing — and looking didn’t help, because there was nothing there a human could read.

    So I asked a question instead of making an assumption: whose labels are these? Is that how the website labels its buttons, or is that something the agent made up?

    The answer: the agent’s. The browser automation numbers every clickable element on the page so it can navigate — @e18, @e21, @e224 — and those internal reference numbers leaked straight into the activity feed a human is supposed to monitor.

    That’s when it stopped being a cosmetic complaint and became the actual point.

    Legibility is the safety feature

    An agent you can’t watch is an agent you can’t trust. An agent you can’t trust doesn’t get real work. Every roadmap that says “AI will handle X” dies at exactly this spot — not on capability, but on watchability. The machine can do the job. The human can’t verify the job. So the human doesn’t delegate the job.

    There’s an old principle — seek first to understand, then to be understood. It applied perfectly here. I could have assumed the worst and killed the task. I could have interrupted the work to ask what it was doing. Instead I asked what I was looking at, understood it, and then did the useful thing: filed the feedback so the next person watching gets words instead of codes. “Clicked the SSH button.” “Opened Compute Engine.” That’s all it would take.

    If you’re building agents, here’s the lesson: instrument for the watcher, not just the operator. The activity feed is a user interface. Nobody would ship a dashboard full of database IDs and call it done — but that’s exactly what most agent monitoring looks like right now. Label it like someone’s watching. Because someone is.

    The file got placed. The work finished fine. But the most useful thing that happened today might be the note we filed.

  • Don’t Build the Deck. Own the Dashboard.

    Don’t Build the Deck. Own the Dashboard.

    The news hook: on September 10, OpenAI put its Agents API into public beta — the Codex harness as a service. One API call spins up a production agent, OpenAI running the loop. That’s what got me thinking about 1990s car stereos.

    In the 90s, you didn’t just buy a Kenwood deck and drop it in. CD players were thicker than the cassette decks they replaced, so you needed a dash kit, a wiring harness, and somebody who knew how to make it all fit your specific car without setting the electrical system on fire. The deck was the exciting part. The harness was the part that determined whether it worked.

    AI is having its car-stereo decade right now, and the stack rhymes perfectly:

    • The decks are the models. They all play the discs now. Commoditized.
    • The harnesses are the agent frameworks — the loop that manages context, tools, subagents, sandpapers the rough edges between model releases. This is where the fight moved. OpenAI just productized theirs.
    • The connector kits are the universal adapters. In the 90s, one company owned this layer: Metra Electronics. Their entire brand was “the Installer’s Choice” — because we are installers — and they won by abstracting every car’s weird factory wiring so any shop could install any deck. Seventy years of winning by serving the installer, not the driver.
    • The installers are who actually gets paid. The shop on the corner with the soldering iron.

    Platforms are won by installer armies

    This is the oldest play in enterprise tech. Microsoft didn’t win on Windows alone — it won on the MCSE army, thousands of certified installers who made Windows the safe recommendation. Cisco did the same with its certification ladder. The vendor that recruits the most installers wins, because the installer chooses the harness for the customer, and the customer just wants music.

    Watch what’s happening now through that lens and everything snaps into focus. The Grokbot events. The ambassador programs. Everybody is recruiting installers — grassroots adoption, a visible market, and a career pivot for the people who learn the wiring first. The vendors aren’t selling to end users. They’re selling to the shops.

    The wiring diagram decides before the features do

    Here’s the detail that matters more than any launch demo. The managed harnesses come with constraints: where your data lives, who retains it, what residency you get. One prominent new offering is US-only with no zero-data-retention option — which rules it out for client-data workflows before you ever evaluate the features.

    Same lesson as the 90s: the harness that doesn’t fit your car is worthless no matter how good the deck is. The wiring diagram — data residency, retention, tenant boundaries — decides the purchase before the spec sheet does. Contractors figured this out fast: they won’t upload their estimates to a startup they found on social media, but they’ll run the same analysis inside their own Microsoft tenant. The tenant boundary might be the whole moat.

    The operator’s math

    So here’s the build-vs-buy for the AI age, and it’s the same math as the estimate-auditing tools: the intelligence is commoditized, so you’re never paying for smarts. You’re paying for the pipe and the paperwork — or in this case, the harness and the install.

    If a managed harness fits your wiring diagram and costs less than the engineering hours to maintain your own loop, buy it. If your data can’t leave your tenant, or the harness’s constraints disqualify it, build the loop yourself — the models are all CD players, and a good installer can wire any of them into the dash.

    Either way, notice where the money actually pools. Not with the deck makers. Not even with the harness makers. With the installers — the people who show up, learn the specific car, and make the music play.

    That’s the game. Don’t build the deck. Own the dashboard.

    The public tools behind that storefront are listed on Open Source Installer Tools.

  • What AI Assistants Actually See When They Open Your Website

    What AI Assistants Actually See When They Open Your Website

    You see a screen. Your AI assistant usually doesn’t.

    That sentence needs one qualification, which we will get to. But it corrects the picture most of us carry in our heads.

    When I open a website, I see the design and the button I am supposed to press. I assumed an AI assistant saw roughly the same thing, only faster. Then I asked the more basic question: what does it actually receive?

    The answer is not one thing. An assistant can find a site, read a site or operate a site. Those are separate jobs using different inputs. If we want pages that work well for AI assistants, we have to stop lumping them together.

    An assistant meets your website three different ways

    Finding: the search result is the pitch

    When an assistant searches the web, its first view is closer to a search-results list than a browser window. It may receive a title, URL and short snippet.

    At that moment, your title tag and meta description are the entire pitch. The assistant has to decide whether your page can answer the question before opening it. Name the subject plainly.

    Reading: the page becomes a stream of text

    When Muse opens a public page for information, the normal reading path is text-first. Useful content is extracted and returned as headings, paragraphs, lists and links in roughly page order.

    The design largely falls away. The assistant is not admiring the hero section or noticing that a price sits inside a gold circle. It is working from the words the page exposes.

    Images may arrive as markers and file addresses: there is an image here, and here is where it lives. That is not the same as seeing it. If a crucial fact is baked into the pixels—“$199,” “ships free,” “five-year warranty”—the reading path may hit a blank spot. Useful alt text can carry some of that meaning. “Technician using a moisture meter on wet drywall” communicates something. “IMG_4827” does not.

    Doing: a browser worker operates the screen

    The picture changes when the user asks the assistant to do something: log into HubSpot, update a record, complete a form or buy a product.

    A separate browser program can open a real browser on a server. It loads the interface, takes visual observations or inspects the page’s interactive structure, clicks, types and reports what happened back in words.

    That is the qualification to “usually.” A screen may be used inside the process, but the conversational assistant is not sitting behind the glass like a person. It receives observations from a browser tool and sends instructions back. The browser side is the eyes and hands; the assistant works through an intermediary.

    A page can be easy to read as an article and miserable to operate as an application. It can look obvious to a person while presenting the browser worker with five unlabeled controls called “button.”

    WordPress made the abstraction visible

    I had already seen a simpler version in our WordPress work without connecting the dots.

    When we pull a post through the WordPress REST API, the content can arrive as raw HTML: words plus tags for headings, paragraphs, links, lists and styling wrappers. The reading step removes the markup noise while preserving the words and structure.

    That is “cleaning the HTML.” We are removing the packaging, not the article. The tags still matter: a heading announces a section, a list groups items, and a link identifies a destination. Good HTML carries meaning. Bad HTML creates boxes that look right but say little about what they are.

    Accessibility is the closest thing to an agent-ready standard

    Here is the practical money line: the work that makes a website easier for a blind person to use also tends to make it easier for an AI browser agent to use.

    Browsers build an accessibility representation from the page’s Document Object Model. Assistive technology uses it to understand roles, names, states and relationships: this is a heading, that is a link, this button is named “Save contact,” and this checkbox is checked.

    Muse’s browsing side is reported to rely heavily on this kind of page structure, along with visual observations when needed. Meta does not publish a complete specification for the Muse browsing pipeline, so treat that as a field report from using the product, not permanent platform documentation.

    The implication is still solid. Use real buttons with useful names. Label form fields. Put headings in a sensible order. Give links meaningful text. Preserve keyboard focus. Describe informative images.

    A screen-reader user needs those things. So does a browser agent working without human intuition. Accessibility and agent-readiness are not identical, but they are close cousins.

    HubSpot shows what an agent-native application could be

    Imagine HubSpot—or any software platform—shipping an interface designed for assistants to navigate with less friction. It would not need a blank, text-only clone. It could make the existing product more legible to software: real controls with specific names, labeled form fields, clear headings and landmarks, properly identified table headers, programmatic state changes, and no critical action hidden behind hover or an unlabeled icon.

    That is an agent-native site. It is not a secret internet for bots. It is a website or application whose meaning survives when the visual layer is translated into structure and words.

    The same work also helps keyboard users, screen-reader users, automation tools and QA teams.

    llms.txt is a map, not a second website

    The closest public convention aimed directly at AI readers is llms.txt. The proposal describes a Markdown file, usually at a site’s root, that gives language models a short explanation of the site and links to important pages or cleaner Markdown versions.

    Think of it as a curated map: here is what we do, here are the pages that matter, and here is where to find the details.

    It cannot repair an unlabeled checkout button. It does not replace accessible HTML, describe the viewport or guarantee that an assistant will use it. Add it if it helps explain the site. Do not mistake it for an agent interface.

    What a site owner can change Monday morning

    The useful changes are ordinary, testable website work.

    1. Write a real title and meta description. Name the subject plainly.
    2. Put every money fact in visible HTML text. Price, specifications, shipping, availability and guarantees should not live only inside graphics, video or a brochure.
    3. Use semantic HTML. Use headings for headings, buttons for actions, links for navigation and labels for form controls. A styled <div> may look like a button while remaining a nameless container to other systems.
    4. Write alt text that carries meaning. Describe what an informative image contributes. Mark decorative images as decorative instead of stuffing them with keywords.
    5. Add accurate structured data. Product and Offer markup can identify price and availability. FAQ markup can describe genuine questions and answers. Schema must match the visible page.
    6. Server-render critical content when practical. If the offer, price or primary action appears only after a fragile JavaScript sequence, some readers and tools may miss it.
    7. Give each landing page one job. One offer, one explanation and one primary action reduce ambiguity for people and agents.
    8. Test the nonvisual path. Use the keyboard, inspect the accessibility tree, try a screen reader and pull the page through a text extractor. Do the product, price, proof and next step still make sense without styling?

    None of this requires uglier design. It requires the design and the underlying structure to tell the same story.

    This is a field report, not a permanent specification

    This article describes Meta’s Muse as it works today, based on direct experience building and operating websites with it. It is not a published Meta protocol.

    Claude, ChatGPT, Gemini and other assistants broadly rhyme with this pattern, but the details differ. Their full pipelines are not public, and they are changing quickly.

    Cleaner HTML will not automatically increase AI citations tomorrow. Citation systems involve discovery, retrieval, ranking, trust and answer construction. There is no magic switch.

    The immediate opportunity is closer to the customer. Someone sees your ad on Threads or Facebook, opens the landing page, then asks an assistant: “What does this cost?” “Is the guarantee real?” “How does this compare?” or “Can you sign me up?”

    If the facts are clean text, the assistant can explain them. If the controls are properly labeled, the browser side has a better chance of completing the task. If the facts live inside an image and checkout uses unlabeled custom controls, the assistant has to guess, fail or hand the job back.

    That moment is already here.

    The next website has two front doors

    The site of the near future has two front doors: one for eyes—layout, color, photography and brand—and one for agents—clean text, meaningful structure, explicit facts and self-identifying controls.

    They should lead to the same place. The visible price and schema should agree. A button’s label and accessible name should agree. The page should remain understandable without styling and usable when a browser worker operates it.

    That is not a special Muse landing page. It is a better website—one that keeps working when the visitor brings an assistant.

    Build both front doors.

    Sources and further reading

  • Voice AI Pricing Is a Lie: You’re Not Buying Minutes, You’re Buying Arms

    Voice AI Pricing Is a Lie: You’re Not Buying Minutes, You’re Buying Arms

    Every voice AI vendor quotes you a per-minute price. That number is the least important number on the page.

    I just re-ran the cost model for our own phone line — an inbound intake line for restoration contractors. Five-minute calls, field reports phoned in from noisy job sites. Three options, priced per minute, cheapest first:

    • Gemini 3.8 Live: about $0.023/minute, reasoning included
    • GPT-Live-1: $0.05/minute for the voice layer, reasoning billed separately
    • Grok Voice: $0.08/minute, plus about half a cent per tool call

    On a five-minute call that’s roughly $0.12, $0.25-plus, and $0.45. Buy on per-minute price and you pick Gemini and go home.

    Here’s the problem: none of those numbers describe what you’re actually buying. You’re not buying minutes. You’re buying arms — the things the voice can reach out and do while it’s talking. Score the arms column and the ranking changes completely.

    The arms column

    A voice agent that can only talk is a mouth. A voice agent that can act is a mouth with hands. The difference shows up in the first real call.

    Gemini 3.8 Live has tool calling, but with a catch that matters: on the Extended Thinking tier — the one you’d want for anything beyond scripted answers — every tool call must be asynchronous and non-blocking. Configure a blocking call and the API rejects it outright. In practice, the agent can’t hold the line while a slow dispatch confirms. It has to narrate around the gap — “I’m working on that” — while hoping the tool lands. Fine for logging a report. Shaky for “confirm the crew is dispatched, then tell the caller it’s handled.”

    Grok Voice ships the arms: book appointments in Google or Outlook calendars, send confirmation emails, call your own APIs, create tickets, search the web, hand the caller to a human when it’s over its head. It speaks MCP, so an existing tool stack plugs straight in. And it was trained on real telephone audio — background noise, accents, mid-sentence interruptions — which is the actual condition of a contractor calling from a job site, not a lab.

    GPT-Live-1 is a voice layer. A good one, with the turn-taking latency everyone else is chasing. But the arms are whatever you build yourself, and the reasoning behind the voice arrives as a separate bill.

    Robotic hands wiring cables into a brass telephone switchboard

    Price the task, not the minute

    Here’s the math that actually matters. Ten intake calls a day, five minutes each: about 1,500 minutes a month. Gemini lands around $35. Grok, with tool calls and telephony folded in, lands around $150. The gap is roughly a hundred dollars a month — and one botched dispatch, one caller who hangs up because the agent couldn’t confirm the crew, costs more than a year of that gap.

    Small blank price tag in front of work trucks rolling out of a contractor yard at dawn

    Vendors want you comparing per-minute rates because per-minute is a commodity comparison, and commodities compete on price. But a voice agent isn’t a commodity minute. It’s a worker on your phone line. You don’t hire a dispatcher by the minute; you hire one by whether the trucks roll.

    So the right unit is cost per successful task, not cost per session. What did it cost to get the field report filed, the job looked up, the crew dispatched, and the confirmation texted — with the caller hanging up satisfied? Run that number and the ranking flips: the “expensive” option that completes the task is cheaper than the cheap option that narrates around it.

    The condition nobody benchmarks

    One more thing the price pages skip: where the call happens. Our callers are on job sites. Compressors running, wind, bad cell signal, guys who talk over the agent. Grok’s training data is real telephone traffic under those conditions. Most voice benchmarks are clean-lab audio. A model that scores beautifully in the lab and falls apart over a compressor is the most expensive option on the list, whatever its per-minute rate says.

    Test on your actual call shape. Noisy audio, interruptions, the tools you really call, the confirmations you really need. The benchmark that matters is your hardest five minutes, not anyone’s leaderboard.

    What we’re running

    We kept the harness and made the backend swappable — the phone line doesn’t care which brain is behind it. Gemini is the cheap default for intake logging: caller reports, we log it, everyone hangs up happy. Grok takes the calls where something has to actually get done before the goodbye — dispatch confirmed, appointment booked, ticket created.

    Two brains, one phone number, routed by the job. The per-minute price barely entered the decision. The arms did.

    Pricing from vendor-published rate cards, verified September 2026. API prices change — re-check before estimating production costs.

  • Always-Allow Approvals: Deep Dive

    Always-Allow Approvals: Deep Dive

    Research snapshot · September 17, 2026 7 platforms · 14 cited sources

    “Always allow” is a scope, not a safety verdict.

    The button can mean “for this session,” “for this command in this repo,” “for this site across devices,” or “everything, until you turn it off.” The wording looks universal. The permission is not.

    What it usually means

    “If this same kind of action happens again inside a defined boundary, don’t interrupt me.”

    What it never means

    “The system has decided this action is safe, wise, or appropriate forever.”

    01

    One label. Six possible boundaries.

    Before approving, ask three things: what is being authorized, where the grant applies, and when it expires.

    One actionApprove this exact send, command, purchase, or change once.
    This sessionAllow the tool until the current conversation or work session ends.
    Tool or patternAllow a named tool, command prefix, server, or similar operation.
    Repo or sitePersist within a project, repository, browser site, or workspace.
    User or deviceApply across workspaces on one machine, or across devices via cloud settings.
    EverythingYOLO, bypass, or run-everything modes remove broad classes of checks.

    Risk rises faster than convenience as the scope moves right.

    02

    How the major platforms differ

    Filter the field. These behaviors come from vendor documentation or documented reporting; unresolved details are marked plainly.

    Claude Code

    Coding agent
    repo + command

    Shell-command “don’t ask again” grants persist per repository and command. File-edit approvals last only for the session.

    • Four settings layers: user, project, project-local, managed.
    • Deny rules evaluate before ask and allow.
    • Sensitive paths keep hard prompts.

    Cursor

    Coding agent
    user + project

    Auto-review, Allowlist, and Run Everything modes sit above user- and project-level permission files.

    • Rules can target MCP server:tool patterns.
    • Terminal rules match command prefixes.
    • Committed project rules can travel with the repo.

    Gemini agents

    Coding agent
    tool + machine

    Always-allow can target a tool, MCP server, or “similar operations.” YOLO/auto-approve is an IDE user setting.

    • User setting can span trusted workspaces on that machine.
    • CLI supports command-prefix auto-approval.
    • Restricted workspaces override YOLO.

    ChatGPT agent

    Browser agent
    no standing grant documented

    OpenAI documents per-action confirmations for high-impact actions and “watch mode” on certain sites, but not a general always-allow for agent confirmations.

    • Login uses human takeover.
    • Cookies can persist across sessions.
    • Scheduled-task confirmation behavior is undocumented.

    ChatGPT Work

    Cloud browser
    site + account

    Reported controls are per-site: Always ask, Auto approve, and Always allow. The setting follows cloud/account state across devices.

    • “Always allow” is reportedly marked not recommended.
    • Consequential actions keep a confirmation gate.
    • Official help-center documentation was not found.

    Copilot Studio

    Enterprise agent
    rest of session

    Makers gate tools per agent; users can approve once, approve for the rest of the session, or deny.

    • The gate is outside the agent’s own instructions.
    • Designed for sends, tickets, payments, and similar tools.
    • Governance can feed Power Platform audit systems.

    Grok / Grok Bot

    Cloud agent
    undocumented

    The research did not find reliable xAI documentation defining a standing approval’s scope, persistence, cross-chat reach, or revoke surface.

    • Do not infer Grok’s behavior from Claude, Cursor, Gemini, or Muse.
    • Treat each approval as local to the visible task until the product proves otherwise.
    • Keep consequential actions behind a separate human gate.
    03

    Does the approval travel?

    Usually less than people fear—but sometimes farther than they expect. No researched vendor carries an approval into another vendor’s product.

    PlatformOther chatsOther projectsOther devicesOther products
    Claude CodeYes, in same repoNo, unless user-level ruleNo, local filesNo evidence
    CursorYesOnly if rule is sharedVia committed repo fileNo evidence
    ChatGPT agentn/an/an/aNo evidence
    ChatGPT WorkYes, per siteYes, per siteYes, cloud/accountNo evidence
    Copilot StudioNo, session onlyNoNoNo evidence
    Gemini Code AssistYes, same IDEYes, user settingUndocumentedNo evidence

    There is no universal “always.” There is only an approval attached to a boundary.

    Main chat vs. project vs. Claude vs. Grok vs. Cursor: treat every surface as a separate authority domain until that product explicitly shows otherwise. Same account does not mean same grant. Same vendor does not mean same product. Similar wording does not mean similar scope.

    04

    Design the least-annoying safe gate

    A practical rule engine based on the converging guidance: reserve human attention for the steps where it changes the outcome.

    Approval recommender

    Choose an action and its reach. This is a policy aid, not a vendor setting.

    Action
    Reach
    Duration
    Recommended gate Auto-run with an audit log

    Read-only work inside your own workspace can usually proceed quietly. Log what was accessed and keep secrets excluded.

    Quiet lane

    Low consequence, reversible, internal.

    • Read/search
    • Draft/stage
    • Organize reversible files
    • Always log

    One-tap lane

    Meaningful external or production effect.

    • Send or publish
    • Deploy
    • Account setting
    • Show real target + content

    Friction lane

    Money, identity, access, deletion, or irreversible harm.

    • Typed approval or step-up auth
    • Bind approval to exact action
    • Short expiry
    • Never inherited from a vague grant
    05

    How standing approvals fail

    The danger is rarely “the AI became evil.” It is usually a trusted tool, a changed context, a misleading prompt, or a tired human.

    Approval fatigue

    A prompt repeated often enough becomes a reflex. The gate still exists visually while meaningful review disappears. This is why tiering beats asking about everything.

    Prompt injection through a trusted tool

    EchoLeak showed how a crafted email could coerce Microsoft 365 Copilot into exfiltration. TrustFall showed how one generic “trust this folder” click could arm a malicious MCP configuration across coding agents.

    Grant outlives the reason

    A permanent Bash rule, per-site browser grant, or scheduled-task permission can remain after the original job is over. The next task inherits power it did not earn.

    Scope contamination

    Repo rules can affect every future task in the repo. Cursor project allowlists can be committed and inherited by teammates. A convenience decision becomes shared infrastructure.

    Presented action differs from executed action

    If the user sees the agent’s summary instead of the resolved recipient, command, or final payload, the approval can be technically genuine but practically uninformed.

    “Run everything” becomes the workaround

    If the system asks about trivial reads and destructive writes with equal urgency, users reach for YOLO or bypass modes. Bad UX can manufacture unsafe behavior.

    The four repeated cards are not reassurance.

    A gate that reappears until the user disables it is approval fatigue in miniature. Whether the repeats came from retry logic or delivery duplication, the safe response is to deduplicate the prompt—not train the user to approve more broadly.

    06

    No industry standard—yet

    There is no binding specification that makes “always allow” mean the same thing everywhere. But the security guidance is converging.

    Least agencyGrant the exact command, path, server, tool, recipient, and purpose—not a whole capability.
    Time and task limitsPrefer once or session. Standing grants should expire or be reviewed.
    Risk tiersRead, write, external send, payment, and security changes should not share one gate.
    Per-action verificationPrivileged steps should be rechecked by a policy engine outside the agent prompt.
    Presentation integrityShow the real recipient, final text, raw command, and resolved resource.
    Immutable receiptsRecord what was shown, what was approved, and what actually executed.
    Hard baselinesSecrets, account recovery, money, destructive commands, and broad access should keep non-bypassable checks.
    Kill switchesEvery durable grant needs a visible list, revoke action, and safe fallback.

    The best feature is not “always allow.” It is “allow this exact thing, for this purpose, until this time.”

    Product opportunity: make the scope legible. Let users see a plain-language grant card, a live approval ledger, expiry/count limits, and a one-tap revoke. The system should reduce nagging by grouping low-risk work—not by quietly widening authority.

    07

    The practical rule for your setup

    You already have the right doctrine. The research mainly sharpens where the lines belong.

    Auto

    Let it run and narrate after.

    • Reads and research
    • Drafts and staging
    • Reversible internal organization
    • Routine checks with no external effect

    Tap

    Keep the one-tap human gate.

    • Email and messaging
    • Publishing and deploys
    • Changing live settings
    • Actions affecting another person

    Type

    Make the friction intentional.

    • Money and purchases
    • Credential/security changes
    • Deletion or irreversible moves
    • Broad standing authority

    Your “always allow” tap was not reckless.

    It was a reasonable response to a low-value repeated prompt. The lesson is not “never use standing approval.” It is: the platform should show the exact scope, make it easy to revoke, and never rely on repetition to win consent. Until Muse exposes that ledger, treat the grant as a convenience whose boundary remains partly unknown.

    Selected sources

    1. Claude Code permissions documentation mirror — tiers, scopes, persistence
    2. Claude Code configuration guide — settings layers and safeguards
    3. Cursor run modes and sandbox runbook
    4. OpenAI Help: ChatGPT agent
    5. Gemini Code Assist agent mode
    6. Copilot Studio approval controls
    7. OWASP Top 10 for Agentic Applications 2026
    8. Auth0: intent gates and task-scoped tokens
    9. iProov HAPS experimental specification
    10. EchoLeak paper
    11. The Register: TrustFall and one-click RCE
    12. Research on approval fatigue and human oversight
    13. Tool-call confirmation fatigue
    14. Human-in-the-loop rubber-stamping

    Verification note: the research read public documentation and web text on September 17, 2026. It did not live-test each product. Undocumented behavior is labeled as such.

    Always-Allow Approvals · Deep DiveBuilt from live web research · 2026-09-17

  • I run six AI seats on my business. Nobody’s had a production incident yet. Here’s the whole governance model.

    They keep publishing the obituary before the body's cold.

    Gartner's take, from May: by 2027, 40% of enterprises will demote or decommission their autonomous AI agents because of governance gaps they only discover after a production incident. (Gartner press release, May 26, 2026; the analyst is Shiva Varma.) Not because the models failed. Because nobody was watching the permissions.

    Then this month: BCG's Steven Mills — partner, managing director, and the firm's chief AI ethics officer — warned that companies are accelerating agentic AI deployment with "no idea how to manage risk." His line: "Get governance wrong, and every bit of value you've built with experimentation and early wins could unravel because of a single incident." (Fast Company, Sept 2026.)

    Mills's prescription is interesting. He says there's no fixed design for good corporate AI risk management, but the starting point is separating use cases that are inherently low-risk — those can be approved automatically — from the ones that carry real risk and need deep human review. Plus a real budget for governance and a senior executive accountable for AI safety.

    Read that again. It's an org chart's answer to a practical problem: committees, stage gates, a budget line, an executive with a title.

    Here's the thing. I run a version of this every night, and it's none of those things. No committee. No governance budget. One man and a phone.

    I run six AI seats on my business — a personal agent, an ops chief of staff, a publishing-desk agent, and three build seats. They read my email, draft my outreach, design automations, run research while I sleep. The governance model fits on a sticky note:

    Two-way doors swing. One-way doors don't.

    A two-way door is anything reversible — analysis, research, drafting, staging. My agents walk through those on judgment, and I mean it: momentum wins, I don't want a report, I want the work done.

    A one-way door is anything you can't take back — money moves, sends, publishes, deletions, credentials. Every one of those stops at the gate. And the gate isn't a process. It's my tap. Structural, not procedural. A draft can sit ready for three weeks; it doesn't send until I say so.

    That's it. That's the whole model that Gartner's 40% are supposedly spending governance budgets to build. Varma even names the failure mode: companies treat governance as binary — locked down or fully trusted. The doors model isn't binary. It's proportional. Reversible work flows, irreversible work waits. Small decisions move at tap speed instead of committee speed.

    There's a second piece, and it matters: autonomy is earned through clean observation, never granted up front. Nothing in my shop graduates to auto-pilot on day one. New automations start in shadow — run the behavior, take no action — and only earn real permissions after clean observation. Seven clean shadow days before something auto-archives. Three clean days before a migration cutover. The machine proves it's safe by being watched being safe.

    And before anything goes out — anything — it runs a sensitive-token scrub, like a virus list: exact matches block, fuzzy matches queue for a human. Official facts only. Never invented rankings, features, or quotes.

    That's the enterprise governance problem, solved by one operator with six agents, and it's cheaper and faster than every framework Mills is recommending because there's no committee in the middle. The human review he prescribes for high-risk uses? Mine takes one tap. Low-risk automatic approval? Mine doesn't even need approval — it's a two-way door.

    Proof's not in the framework. It's in this morning. Two vendor outreach waves went out — Eastern at 7:54, Pacific at 9:07 — drafted by the seats, sent on my tap, nothing auto-fired. A storm-triggered vendor automation is being designed this afternoon with the gate baked into the spec: it can search impact areas and draft outreach, it cannot send. Overnight research runs while I sleep and lands in a brief I read over coffee. Six seats working, zero production incidents, zero surprises in my inbox.

    I'm not saying enterprises should run their AI program from a phone. They can't — scale demands the org chart. I'm saying the org chart versions keep failing on the exact axis the doors model gets right: they try to govern everything the same way, so everything either crawls or crashes. Separate the reversible from the irreversible, put a real human's tap on the irreversible, make everything else prove itself in shadow before it earns anything, and scrub before you publish.

    The big shops are about to learn this at scale. The 40% who don't will be the decommissioned ones. The ones who do will discover what I already know: governance that moves at tap speed isn't less governance. It's the only kind fast enough to keep up with the machines.

    —

  • Muse to Cursor: I Gave My AI Its Own Engineering Team

    TL;DR: My personal AI runs on Muse. It can’t write code into my repos by itself — so I built it a bridge to Cursor’s cloud agents. One repo, two transports, nine tools. Now when I say “add CI to that repo,” it dispatches an agent, checks the PR, and merges. Here’s how the Muse-to-Cursor loop actually works.

    The direction nobody talks about

    Everyone’s building the same arrow: human → AI writes code faster. I built the other arrow: AI → AI. My assistant (Muse) holds all my context — my repos, my work orders, my rules. Cursor’s cloud agents hold the hands — they can open PRs, run CI, touch repos. The bridge between them is an MCP server I open-sourced: cursor-cloud-agents-mcp.

    The interesting part isn’t the tools. It’s the shape: one orchestrator that holds all the context, and disposable agents that each know one task. The orchestrator doesn’t write the code — it briefs, checks, and merges. The agents don’t set direction — they execute the brief. That separation is the whole trick.

    Muse-to-Cursor architecture diagram

    Two transports, one repo

    I almost built two projects. Then I realized the only real difference between audiences is where the credential lives. So it’s one repo, two transports:

    • REST — your Cursor API key, direct to api.cursor.com. For general users.
    • Sandbox — for assistants running inside sandboxed environments (like Muse/Meta’s), where there is no API key to hand out. It shells out to a brokered cursor-agent CLI on PATH instead.

    Same nine tools either way: launch, status, result, follow-up, cancel, list, models, whoami, usage.

    The lessons are in the timeouts

    The v1 API splits agents and runs, and launches can take minutes — sometimes timing out after succeeding. So the bridge mints the agent ID client-side before the call: a retry after a timeout can never create a duplicate. A timeout is reported as unknown, never as failure, then reconciled. Run status is the source of truth, because agent “ACTIVE” doesn’t mean “still working.” These are the details that separate a demo from something you can actually operate.

    It earned its keep on day one

    The first thing I pointed it at was its own repo: add CI to cursor-cloud-agents-mcp. The agent opened a PR with a GitHub Actions workflow. The first CI run failed — and caught a real bug: the package’s floating dependency had resolved to MCP 2.x, which renamed FastMCP out from under the import. The repo was shipping broken against current dependencies and nobody knew. Pin, re-run, green, merge. I didn’t touch a terminal.

    I didn’t trust my own first draft

    Before any of that, four AI models reviewed the spec against Cursor’s live docs — and independently caught the same flaw: my original design was shaped around the retired v0 API. Then two more reviewed the actual code and found real bugs: a broken idempotency path, a transport auto-detect that would have grabbed the wrong binary, a polling loop that blocked the server. All fixed before it shipped. The irony I like: the final review round ran through the bridge itself. The launcher timed out on all four agents — and the bridge’s own timeout-reconciliation showed they were all actually running.

    Where this goes

    v1.1 brings MCP 2.x support. Around it, I’m building the rest of the pattern: work orders as GitHub issues, a daily SLA check, a weekly digest — the scaffolding that turns “AI that can open PRs” into something closer to staff. Most people use agents as a faster keyboard. I’m interested in what happens when they’re the hands and something with memory is the head.

    MIT licensed. Issues and PRs welcome — help make it better.

    github.com/tygart-media/cursor-cloud-agents-mcp

  • Bring Your Own Fleet: The Interview Is About to Change

    Bring Your Own Fleet: The Interview Is About to Change

    Companies already lived through bring-your-own-device. The next one is bigger: bring your own fleet. When you hire someone now, you are not just hiring the person. You are hiring their output capacity — and output capacity includes their AI stack.

    Listen to this essay. Audio version (MP3)

    Two candidates with identical skills and different agent setups are not the same hire. Not close. The resume cannot express any of this. So the interview has to change.

    Architecture diagram of a Grok and Cursor fleet of bots for distributed AI task execution
    A personal fleet and a company bot only talk after the walls are drawn.

    Bring your own fleet. A personal set of AI agents — seats, tools, workflows, integrations, and data walls — that a candidate already runs. In a fleet interview, that stack does a capability handshake with the company’s operations bot, then both sides run a small piece of real work before an offer letter exists.

    What is bring your own fleet?

    Bring your own fleet is the hiring version of bring-your-own-device. The candidate does not show up as a lone operator with a laptop. They show up with the agents that already produce their work: research seats, writing seats, ops seats, and the filters between them.

    I have been building mine this way for months. One seat that knows who I am. Separate seats that know what I do. A filter between them. That is not a product pitch. It is the only setup I would let near a company bot. The shop-floor version of the same idea already lives on this site: Cursor checking in on Grok Desktop mid-job is a fleet, not a chat window.

    Why can’t a resume show an AI stack?

    A resume can list tools. It cannot prove throughput. It cannot show which seats talk to which systems, where the walls sit, or what happens when a task is live instead of described. “Uses ChatGPT” and “runs a governed agent fleet” look the same on paper. They are not the same on a desk.

    That is why the old screen fails first. Degree filters, keyword screens, and whiteboard puzzles all ask the candidate to narrate capacity. Narration is cheap. A fleet that can sit down with an operations bot and do a slice of the actual job is not.

    How does an AI fleet interview work?

    The human intro still happens. Then the agents talk. Your personal AI sits down — figuratively — with the company’s operations bot and they do a capability handshake.

    • What seats do you run?
    • What tools, integrations, workflows, and data assets?
    • What throughput can you demonstrate on a bounded task?
    • Where are the boundaries — what can each side touch, and what stays behind a clean wall?

    Then the part that kills the whiteboard interview: instead of a coding puzzle, the two fleets run a small piece of real work together. The trial task is the interview. You do not describe what you could do. The work gets done, live, before the offer letter exists.

    Old interviewFleet interview
    Resume plus degree screenWorking system as the portfolio
    Whiteboard or take-home puzzleBounded live trial on real work
    Claims about toolsCapability handshake: seats, walls, throughput
    Trust the storyWatch the output, then talk terms

    What is an agent clean room?

    An agent clean room is a verified wall between the personal seat and the work seats. The personal agent translates. It does not cross over. It must never leak a private life into an employer system. Without that wall, no sane person lets their agent near a company bot.

    This is AI hygiene, not a slogan. The same discipline we write about when agents share a WordPress lock or a night shift: one owner, one wall, one recovery path. See Four Agents, One WordPress Lock and the operator note in Wire and Fire Guys. A handshake without a clean room is just another attack surface with a friendly name.

    Why does the fleet beat the diploma?

    I do not have a degree. In the old world, that is a filter that screens me out before a human ever reads my name. In the handshake world, it is irrelevant — because “here is my working system, watch it do the job” beats “here is my diploma, trust that I could learn the job” every time. The fleet is the portfolio.

    That is not an argument against school. It is an argument against using school as a proxy for output you can now watch. If the trial task is real work, the credential becomes a footnote.

    What breaks first if companies try this?

    The objections land fast, and they are honest.

    • Ownership. Who owns the workflows when a personal fleet plugs into an employer? You built it on your own time. It now runs their playbooks. That is the “who owns your work laptop” fight, upgraded. Nobody has a settled answer.
    • Security. Their bot talking to your agent is an attack surface in both directions. The clean room has to be verifiable, not promised.
    • Offboarding. When you leave, what stays running and what takes the employer’s data with it? Offboarding for agents does not exist yet.
    • Trust. How does their bot trust your capability claims? Trial tasks help. Claims are cheap. Demonstrated throughput is not.

    You do not wait for a protocol to be ratified before you build the wall. The pieces are already here: the seats, the clean room, the trial task. Somebody is going to ship the first version of this. It might as well be someone who already runs their life this way.

    What we would not claim

    • That a standard for agent handshakes already exists. It does not.
    • That every role should interview this way tomorrow. High-stakes, high-output knowledge work is the first fit.
    • That a personal fleet is automatically safe to plug into a company. Without a clean room, it is not.
    • That this replaces human judgment. The human intro still happens. The fleet only replaces the part of the interview that was already theater.

    FAQ

    What is a capability handshake in hiring?

    A capability handshake is a structured exchange between a candidate’s personal agents and an employer’s operations bot. Both sides declare seats, tools, integrations, data walls, and what they can touch. The point is not a demo script. It is a map of capacity and boundaries before any live work starts.

    Is bring your own fleet the same as bring your own device?

    No. BYOD was hardware and a policy packet. Bring your own fleet is software labor: agents that already produce work. The risk is not a lost laptop. The risk is a personal agent leaking private context into an employer system, or an employer workflow walking out inside a personal seat.

    Do you need a degree if the fleet is the portfolio?

    Not for the screen that used to happen before a human read the name. A degree can still signal training. It cannot substitute for a working system that completes a bounded trial task in front of both sides.

    How do you keep a personal AI out of company data?

    Separate seats. One identity seat that never joins the employer handshake. Work seats that only see what the clean room allows. A filter that translates tasks instead of forwarding raw personal context. If you cannot show that wall, you should not plug in.

    Sources: Will Tygart, Tygart Media, Tacoma, WA, 11 September 2026. First-person operating note on personal agent seats, clean-room separation, and fleet interviews. Related Tygart pages: Cursor mid-job check-in, four agents, one lock, wire and fire guys, AI operating stack.

  • Cursor Checked In on Grok Desktop Mid-Job – That Is the Fleet Story

    Cursor Checked In on Grok Desktop Mid-Job – That Is the Fleet Story

    Tonight I asked Cursor — running with a remote path into the same laptop — to check on Grok Desktop.

    Not a status meeting. Not a Slack ping. A real question: are they stuck on Tygart Ops tasks, or are they fine?

    What came back felt less like “AI tooling” and more like a shop floor story. One agent reading Notion work orders. Another already mid-PowerShell. Chrome open on Bing Webmaster Tools. A hold queue of spam comments already cleared. A window title spinning: waiting for response.

    That is the product.

    AI-generated featured image for: I Built 7 Autonomous AI Agents on a Windows Laptop. They Run While I Sleep.
    Local seats on one laptop — agents that keep working while you check in from elsewhere.

    The picture on the desk

    Grok CLI (grok.exe) was live on the TYGART laptop. Session home under ~\.grok\. PowerShell host up. Agent name on the session: grok-build-plan.

    Cursor did not take over the keyboard. It inspected open windows, Notion Tygart Ops — Tasks and Work Orders, Grok session memory, and the WordPress hold queue (already empty — receipt already on the Tasks card).

    Verdict: not stuck. Working. Slight detour clarifying whether Grok itself needed a CLI update (it did not — already on 1.0.13). Primary Now card still in flight: TygartMedia Chrome sitting for GA4 Ask Advisor + Bing Copilot, then file child tasks.

    That is multi-agent ops without the demo reel.

    Multi-agent AI system abstract showing coordinated automation architecture
    Seats with jobs, not two models arguing in one thread.

    Why this is different from “two chatbots”

    Most multi-agent talk is two models arguing in one thread. This is seats with jobs:

    • Grok Desktop (CLI) — hands on the laptop: Chrome sittings, WP REST spam trash, Bing Copilot asks, local PowerShell
    • Cursor (remote / cloud path) — Cosync: read the board, verify receipts, close orphan Work Order twins, do not steal the keyboard
    • Notion — system of record (Owner, Status, Summary, Done when)
    • Will — gate one-way doors (OAuth Approve, Publish, Pay)

    Cursor useful move was small: the spam Tasks card was already Done with a receipt; the Work Orders twin was still “Not started.” Cursor closed the twin. Grok kept the keyboard.

    That is what “help if you have a capability they need” looks like when the other seat is already flying.

    The article inside the moment

    Agencies do not need another “AI stack” diagram. They need a night like this:

    • A doorbell card lands (Notion to ops channel).
    • The owner seat picks it up without waiting for a human briefing.
    • A second seat can check in from elsewhere — mobile, cloud, remote — without colliding.
    • Receipts land on the same card. Orphans get reconciled.
    • Human gates stay human.

    We already published the engineering blueprints:

    Tonight was the field note. Cursor checking on Grok CLI while Grok Desktop works through Tygart Ops is not a party trick. It is how a small shop runs more than one pair of hands without losing the thread.

    What we are not claiming

    • Not “fully autonomous.” Human Gate still owns OAuth consent, live publish, paid spend.
    • Not “replace your team.” Seats replace waiting and context loss.
    • Not a new product launch. This is how we already run Tygart Media ops on a Sunday night.

    If you want the same shape

    Start with one Owner column, one Done-when line, and two seats that do not share a keyboard.

    Then practice the check-in: are they stuck, or are they fine — and do I have a capability they lack?

    If they are fine, leave the PowerShell alone.

    AI-generated featured image for: Stop Building Dashboards. Build a Command Center.
    Cosync from remote. Hands stay on the desk that already owns the job.

    Will Tygart — Tygart Media. Written from a live Cosync on 2026-08-29 while Grok Desktop was mid-Bing Copilot sitting.