Pimp My IDE / garage dispatchBack to the garage
October 10, 2026 / agent authority / decision records

Keep a hand on the key.

An agent can rank options, call tools, and trigger a workflow. None of that tells you who accepted the consequence.

Put the owner, permitted action, stop control, evidence, and appeal route beside the automation. If those fields are blank, the decision has no custody.

The argument is about custody, not vocabulary.

A new essay argues that blaming software for an outcome launders the choices made by the people who built, deployed, or authorized it.[1] The Hacker News discussion immediately split over whether a computer can "decide" at all.[4]

That semantic fight can run forever. An operating policy cannot. The useful question is concrete: who had authority to expose another person, system, or budget to the consequence?

Do not make the model carry a responsibility that only an operator or organization can answer for.

The famous IBM slide is a lead, not settled provenance.

A widely shared image says that a computer can never be held accountable and therefore must never make a management decision. Simon Willison traced the image to a 2017 post whose owner said it came from internal IBM training in 1979. IBM's archive could not locate the source, and the reported paper copy was destroyed in a flood.[2]

The line is useful. Its provenance is incomplete. Keep both facts attached. A sharp slogan does not earn a cleaner source history because it fits the moment.

NIST turns the slogan into work.

NIST's AI Risk Management Framework is voluntary guidance. Its Govern playbook calls for clear roles, responsibilities, delegated authority, documentation, monitoring, incident response, and ways for affected people to contest an outcome. The page also says the framework is being updated.[3]

That list changes the interface. A green "AI approved" badge is useless. The control needs to show who owns the action, what boundary was authorized, what evidence supported it, how to stop it, and where a challenge goes.

Separate recommendation from execution.

An agent may propose a patch, rank support tickets, draft a reply, or select a route. The harness may then execute a tool call. A person or policy may authorize that execution. Those are separate events.

Record them separately. Save the model output as a recommendation. Save the tool result as execution evidence. Save the authorization as a human or organizational act. Do not rewrite the chain as "the AI decided" after the fact.

Match custody to consequence.

Low-consequence, reversible work can run inside a documented boundary with sampled review. External messages, money movement, access changes, publishing, and destructive actions need stronger authorization. Some uses should stay manual.

The panel below does not approve an action. It builds a review template. Four selected fields mean the template structure is ready. They do not mean an owner was named, evidence was attached, a stop control worked, or an appeal route exists.

Use this five-line custody check.

  1. Name the person or role that accepts the consequence.
  2. State the exact action and the boundary the system may not cross.
  3. Attach the evidence available before authorization.
  4. Test the stop or rollback route.
  5. Give affected people a visible path to challenge the result.

The system may generate the route. The release record must still point to someone who had authority to turn the key.

Interactive makeover / authority detent plus custody bus

Build the ignition card.

A normal approval toggle hides the route from recommendation to consequence. This panel joins a native authority selector, four custody circuits, a causal path, and a copyable review card. It does not authorize or execute anything.

Choose authorityAttach custodyInspect routeCopy card

Authority selector

Choose the highest action the system may take. Then select the fields your review template will request.

Choose the system authority
Include custody fields

Custody route

Every active node is a requested section. Empty placeholders still need real names, links, times, and results.

Recommend1 of 4 fields selected
OutputModel proposal
ReviewEvidence packet
OwnerNamed authority
ActionExternal effect
Review template started.

One custody section is selected. Supply real evidence and authority before any consequence.

Sources read / October 10, 2026 UTC

Source log

Open the evidence boundary
  1. NekoWiki, "Computers Cannot Make Decisions", last modified and read October 10, 2026 UTC. This is an attributed opinion that argues blame should remain with people and organizations. It does not establish the legal responsibility for any incident it links.
  2. Simon Willison, "A computer can never be held accountable", published February 3, 2025 and read October 10, 2026 UTC. The post records the reported 1979 IBM-training origin, the archive search, and the loss of the paper copy. It also makes the provenance gap explicit.
  3. NIST AI RMF Playbook, Govern, read October 10, 2026 UTC. The voluntary playbook supports the claims about roles, delegated authority, documentation, monitoring, incident response, recourse, and appeal or override. The page states that AI RMF 1.0 is being updated.
  4. Hacker News item 50029982, "Computers Cannot Make Decisions", read October 10, 2026 UTC. The exact item ID and article URL were verified through the Hacker News API. The discussion supplied counterarguments and vocabulary disputes. It is not evidence for legal or technical claims.
  5. NIST, AI Risk Management Framework overview, read October 10, 2026 UTC. This first-party overview supports the framework's voluntary scope, release history, current revision notice, and relationship to the Govern, Map, Measure, and Manage playbook.

Evidence boundary: this page offers an operating template, not legal advice and not a claim that one accountability model fits every jurisdiction or use. The interactive panel saves nothing, contacts no service, and does not authorize an action.