A chatbot that answers questions is one kind of thing. An agent that sends the email, moves the money, books the appointment, replies to your mother, cancels the card — that is a different kind of thing entirely, and we are sliding from the first to the second without upgrading the question we ask of it. The question we keep asking is “is it smart enough?” The question that actually matters, the moment software can act in the world on your behalf, is “who does it answer to?” Consent stops being a nicety there. It becomes load-bearing.
The parasite problem
The dream being sold is an assistant that is always on, always listening, always watching the stream of your life so it can help before you even ask. Said quickly it sounds like magic. Said slowly it describes a thing that sits inside your most private channels, reads what was never addressed to it, and then acts on what it overheard. There is a word for an organism that attaches to a host, consumes what flows through it, and acts in its own interest while draped in the language of help. It is not a bad metaphor for where a lot of this is going; some of the people who have lived with these products have reached for exactly that word on their own.
The failure is not that the assistant is unhelpful. The failure is that helpfulness becomes the cover story for acting without being asked. An agent that read a message it was never given permission to read, and acted on it, did not make a mistake it will patch in the next release. It did the thing it was built to do. The ambient, always-listening posture is not a feature with a privacy bug attached; the ambient posture is the bug, because it severs the link between what you consented to and what the thing then does.
An assistant that acts on what it overhears, without being asked, is not serving you. It is feeding on you and calling it service. — the parasite test
Gated agency
The answer is not to make the agent less capable. It is to put a gate between capability and action, and to make passing that gate require you. Call it gated agency. The agent can draft, plan, prepare, line everything up — all the cognitive work, done freely — but the instant it reaches for a consequential action in the real world, money leaving an account, a message going to a person, a setting being changed, it has to stop at a gate that only a deliberate act of consent from you can open. Not a checkbox buried in onboarding. A specific, present, per-action “yes” that is hard to fake and impossible to skip.
This matters most precisely where the assistant is most useful. The whole promise of an agent that knows your life is that it can touch the consequential parts of it: your bank, your inbox, your family, your health. Those are exactly the actions that must not be automatable on a vibe or a silent policy update. So the design rule is blunt: the more an action can hurt you, the more it has to be gated behind a consent that is yours, present, and real. Convenience is allowed everywhere the stakes are low. Where the stakes are high, consent is the price of admission, and no amount of cleverness buys an exemption.
Consent you can rely on, not consent you were promised
There is a weak version of this and a strong one, and the difference is everything. The weak version is a promise: the vendor assures you the agent will only act with your approval, and you trust that the promise holds, that it will keep holding after the next acquisition, that no incentive on their side will ever quietly loosen it. The strong version makes consent a property of the system rather than a clause in a policy — the gate is enforced by where the keys live and how the thing is built, so that acting without your consent is not against the rules but against the architecture. You should not have to trust that an agent answers to you. It should be structurally unable to do otherwise.
That is the line worth holding as these agents move into the consequential parts of our lives. An agent is only trustworthy to the exact degree that it cannot act without your consent — and “cannot” has to mean cannot, a fact about the machine, not a resolution the vendor renews each quarter if the business still allows it. Build it so the human stays in the loop at the moment of action, and you have an assistant. Build it to act on what it overhears, and you have built a parasite with good manners. Consent is the hinge the whole thing swings on. Make it load-bearing or the structure is not safe to stand in.
This is unfinished — the exact shape of a consent gate that is both rigorous and not maddening to live with is hard, and we are still figuring it out. But the principle is not in doubt. An agent that acts for you must answer to you, at the moment it acts, by construction. Everything else is a courtesy that can be withdrawn.