Most teams score agents by demos and token spend. The liability that compounds quietly is permission debt: every new tool widens what the system can do, often without a named owner, a kill switch, or an auditable approval.

This week’s tell is not another model release. It is the gap between “the agent can call twelve tools” and “we can name who approved each one.”

Judgment

If you cannot list the irreversible actions an agent may take on one screen, you do not have an agent product. You have an entropy leak with a chat UI.

Irreversibles usually include: send, pay, delete, deploy, and grant access. Once they fire, rollback costs more than “run the model again.”

Three checks

  1. Irreversibles — name send / pay / delete / deploy / grant and the conditions that trigger them.
  2. Default deny — new tools start locked; unlock is a dated decision, not a config convenience.
  3. Readable receipt — every tool result is untrusted data until a rule promotes it.

Why this matters for both GEO and enterprise agents

Negency sees the same control failure in two lanes:

  • On GEO / AI search visibility, wrong citations usually mean unowned facts — stale pages, inconsistent product copy, or third-party paraphrase.
  • On enterprise agents, incidents usually mean unowned actions — over-broad tool scopes, prompts that smuggle privileges, logs that cannot answer who allowed the write.

Neither is a model-IQ problem. Visibility needs governance of citable facts; agents need governance of accountable actions. Control Brief exists to write that judgment weekly for people who own blast radius — not for slideware demos.

A minimal move you can make this week

  1. Pick one agent already in trial and list every tool it can call.
  2. Mark the irreversible 3–7 items; assign a named owner and a kill switch.
  3. Change “new tools default on” to “new tools default off,” and record who approved the last unlock.

If you want the same control language applied to customer-visible AI citations and internal agent pilots, start with the brief, then decide whether a diagnostic is worth booking.

Subscribe: Control Brief on Substack. Issue #1: Your agent stack is accruing permission debt.