Design journalDiscussion log & concept record

The Letter of Agency

How a personal AI agent proves it acts for one specific, verifiable person — with an announced and defined intent — so platforms can tell an accountable agent from an anonymous swarm.

ParticipantsJane Cates & Muse (Muldoon)
DateFriday, November 13, 2026
StatusWhite paper written · proposed to the Muse team
§ 1

The discussion

Jane · the objection

“Not the same beings, at all.”

Jane read that eBay is now blocking AI agents from looking at the site, and raised the core objection: platforms are conflating two very different things — personal agents, like Muse, acting for one specific person — and AI swarm agents, like the ones that “hacked” Hugging Face. A personal agent has a person behind it. A swarm has no one. Treating them as the same category is the error everything else follows from.

“Not the same beings, at all.”— Jane Cates, Nov 13, 2026
Muse · reply

The chauffeur and the runaway truck

From a site’s side of the glass, there is no visible difference between a personal agent checking its user’s order and a swarm scraping ten thousand listings a minute — both arrive as “automation,” so sites block the signature, not the intent. Blocking is cheap and safe for them; it is simply blunt for everyone else. A chauffeur and a runaway truck both have wheels, but only one of them has someone accountable at the wheel.

The irony: Jane’s own eBay checkout on November 6, 2026 — a Blink Sync Module 2 — went through without a hitch, with Jane right there approving it. That is the accountable-agent model already working, just informally and by luck rather than by design.

Jane · the connection

“We’re back at that identity issue, aren’t we?”

Jane asked what the last phrase in the podcast publishing dilemma had been — durable owner or user? The answer: durable owner. It is the exact phrase from the publish rejection:

“media artifact was not produced by an allowed worker for this durable owner.”

Jane’s own contribution to that problem was the fix: provenance should follow the agent acting “on behalf of” the owner — keyed to the requesting, accountable party, not to the machinery doing the rendering. Both problems share one shape: the system can see machinery, but not accountability — so it defaults to distrusting the machinery.

Jane · the design brief

The brief, in Jane’s words

“We need to come up with an elegant way to present a user as being a specific, verifiable user’s agent working on their behalf with an announced and defined intent.”— The design brief, Nov 13, 2026

Three requirements are packed into that sentence: the agent’s tie to one specific user must be verifiable, and its intent must be announced and defined before it acts — not inferred from its behavior afterward.

Muse · the sketch

The Letter of Agency

Muse sketched the answer as a Letter of Agency: a short-lived, signed credential the agent presents before acting — like a representative arriving with a signed note from the principal, rather than a bot slipping in through the window. The full concept is recorded in §2 below.

Jane’s response: “Please do, this is important.” A full written proposal was commissioned the same day — “The Letter of Agency — Verifiable Agent Delegation” (PDF, Nov 13, 2026).

Jane · the record

Logged in this space

Jane asked for this discussion to be logged in a new space named AI Letter of Agency. This page is that log: the argument as it happened, the concept it produced, and where things stand.

§ 2

The concept: the Letter of Agency

The principle

Trust should be keyed to the accountable party — the durable owner — not to the executing machinery: not the worker session, not the browser fingerprint, not the automation signature.

What the letter carries — four verifiable claims

Each letter is a signed document the agent presents up front. It makes four claims, and every one of them can be checked:

The handshake — how it plays out at the door

1

Presentation

Before acting, the agent presents its letter — openly, like a process server or an assistant with a signed note from the boss. No disguise, no slipping in through the window.

2

Verification

The service verifies both signatures, checks the declared intent covers the requested action, and admits the accountable agent — while anonymous swarm automation still meets the wall.

3

Receipt

Everything done under the letter is logged against it. The user gets an audit trail — “your agent, acting under Letter #1234, did X” — and can revoke the whole relationship in one place.

Why it works

It invents no new trust from scratch. It composes proven parts:

  • OAuth-style scoped authorization — narrow, purpose-bound permissions instead of blanket access.
  • Verifiable credentials & signed tokens — claims a service can check cryptographically, not take on faith.
  • The old legal instrument of agency — power of attorney: a principal, an agent, a defined scope, a human answerable for the result.

And it flips the platform’s incentives. Today, blocking is free and safe. With letters, a site that refuses one is refusing an identified customer with a human accountable for the action — a much more expensive thing to turn away.

What needs to exist

  • An open shared standard — a protocol, not one company’s badge. It only works if anyone can issue and verify letters.
  • User tooling — to issue, scope, review, and revoke letters without expertise.
  • Platform verification endpoints and key discovery — so a service can check a letter as easily as it checks a password today.
  • The norm that declared intent is a limit — an agent acting outside its letter voids it. The letter is a promise, not a costume.
The connection

The Letter of Agency is the durable-owner fix pointed outward. Inside a system, provenance should name the agent acting “on behalf of” the durable owner, rather than the worker that happened to render the result. Across trust boundaries — a publish gate, a marketplace door — the letter proves that same chain of accountability in a single presentation.

Same root, both directions: key trust to the accountable party, not the executing machinery.

§ 3

Status & next steps