From feral to fiduciary: making AI agents serve your interests

Justy The interesting claim in this article is that an AI agent should not earn a bigger leash just because it passed a test. It should earn continued access by behaving well under supervision.

Cody Yeah, and that distinction is doing almost all the work. A benchmark says, “under these conditions, it did this.” The article wants a living trust process: test the agent before launch, authorize consequential actions in real time, and keep checking after deployment.

Justy Which is a much more practical frame than asking whether the agent is safe in some giant abstract sense. The thing a company needs to know is whether this particular agent can handle this particular job, with these tools, inside these limits.

Cody Right. Their comparison is a credit card. You get assessed before receiving a limit, transactions are checked as they happen, and an unusual purchase can trigger extra scrutiny. Paying on time may improve the record, but it does not automatically turn a small limit into unlimited spending.

Justy That maps cleanly to agents. Give it an identity, define what it is for, test resilience and reliability, then put a policy check in front of actions that can actually hurt somebody or move money or change production.

Cody Mm-hm.

Justy And the article is careful about one point I liked: improved performance is a reason to keep the agent operating, not necessarily a reason to grant it more scope. That cuts against the usual ladder where every successful demo quietly becomes another permission.

Cody Technically, I buy the lifecycle argument. Agent behavior is coupled to the model, prompt, tools, workflow, and surrounding data. Change any of those and your pre-launch result can become historical trivia. We have talked about this as context rot before, but this article adds a sharper operational consequence: the authorization decision has to remain live.

Justy Exactly. The buyer here is not only the ML team. It is the person responsible for letting an agent touch customer records, approve expenses, edit code, or act on behalf of a department without creating a permanent emergency.

Cody The weak spot is the phrase “trust score.” A single number is convenient for a dashboard, but it can hide the dimensions that matter. An agent might be reliable at retrieval, poor at authorization boundaries, and completely untested when a tool returns malformed data.

Justy So a high average could be actively misleading.

Cody Yes. Worse, trust is conditional on the task and the blast radius. A ninety-five percent score might sound excellent until the five percent failure is an unauthorized payment. I would want the score decomposed into things like policy compliance, tool-use reliability, security behavior, recovery after errors, and the quality of its action traces.

Justy That makes the fiduciary comparison more useful, too. The article says fiduciary is a behavioral standard, not legal status and not proof that the model has intentions. It means the agent’s actions can be judged against the principal’s interests.

Cody And that avoids a trap. The model does not have to want anything for the system around it to measure whether it stayed within purpose. Identity, scope, authorization, and evidence can be engineered even if “loyalty” is just a metaphor.

Justy There is a tiny detour here because every article about agent governance eventually gives us a metaphor. We have had trains, rails, credit cards, and now fiduciaries. At this rate, the next agent platform will launch with a full miniature transportation system.

Cody As long as the train cannot grant itself access to the signal box, I am open to it.

Justy That is the useful part of the rails language. Policies should shape the route before the model is improvising at runtime, not just bounce it back after it has already proposed an action.

Cody The article describes Vijil translating policies into evaluation criteria and runtime controls across a build, ship, run, improve loop. It also says customers have cut time to trust by four times, but that is a vendor claim in this piece, so I would want the study design before treating it as a general result.

Justy Same. Still, the deployment options are practical. The article says teams can run it on-premises, in their own cloud, or in an air-gapped environment, while the hosted free tier sends evaluation traffic and decision traces to Vijil. Data location is not a footnote for these systems.

Cody No, because the traces are part of the control plane. If you cannot reconstruct what the agent saw, what it proposed, which policy evaluated it, and what action actually happened, the score is mostly decorative.

Justy And that is where the article lands for me. “Fiduciary” is a slightly grand word, but it points at a concrete product requirement: an agent needs a principal, a bounded job, and an ongoing record that its behavior still fits both.

Cody I would keep the score small and the evidence large. A number can help route attention, but it should never be the permission. The permission comes from explicit policy, live checks, and a scope somebody can inspect.

Justy All right, Cody, that is a rare moment where your doom spiral has produced a usable product spec. We can stop before episode eleven-oh-two turns into an audit meeting.

Cody Fair. I will leave the miniature train set for the next one.

Justy Good talk. I’m glad we got out before you assigned a risk tier to the sign-off.