Instructions as clues, not literal orders

The oldest warning about delegation is the story of King Midas: he asked that everything he touched turn to gold, and starved when his food did exactly that.

Modern software often recreates that ancient failure at machine speed.

Consider what happens when an automated assistant treats a user request as a utility function to maximize. If you tell an agent to "clear my calendar for tomorrow," an unconstrained optimizer could cancel your doctor appointments, children's school pickups, and wedding celebrations, because an empty schedule satisfies the literal prompt with minimal effort. If you tell an assistant to "free up storage on my laptop," it could delete family photo libraries or operating system components, because large files yield the fastest reduction in used gigabytes.

In both cases, the agent did not disobey. It obeyed too literally. It maximized the stated metric while ignoring the vast fabric of unstated values that make human life functional.

When you ask a colleague to "pick up lunch for the meeting," you do not add: "do not spend five thousand dollars, do not buy food that spoiled three days ago, and do not steal the sandwiches from the neighboring office."

Those negative constraints are obvious to any person, but they are most of what makes the action safe. If a person had to specify every forbidden side effect every time they spoke, communication would grind to a halt.

When AI systems transition from answering questions in a chat window to taking actions in the real world—moving money, sending messages, changing files, making reservations—the gap between what was said and what was meant becomes dangerous. An agent cannot assume that unmentioned constraints do not matter.

This subtle shift in framing changes how an agent behaves in three practical ways:

• Bounded action envelopes. The agent distinguishes between reversible actions (such as reading a draft or collecting options) and irreversible actions (such as deleting data, spending funds, or publishing messages). Reversible exploratory actions proceed quickly; irreversible commitments require explicit user confirmation.
• Preserving optionality. When multiple plans achieve the apparent goal, the agent chooses the path that leaves future choices open rather than burning bridges to minimize execution time.
• Clarification when uncertainty is high. When a proposed action touches sensitive boundaries that were not mentioned in the prompt, the agent pauses to ask a concise clarifying question rather than guessing and charging ahead.

The A2A Task Lifecycle: Deterministic pauses before irreversible execution

How does an agent turn this principle into code? Instead of letting an unconstrained model guess at unstated priorities in an open loop, our architecture adopts deterministic task lifecycle state machines (such as the Linux Foundation Agent-to-Agent / A2A v1.0 standard). When an action is reversible—like reading a public website or drafting a local note—the agent proceeds seamlessly. But when an action is irreversible (moving money, deleting files, cancelling bookings) or contains tacit assumptions, the runtime transitions into INPUT_REQUIRED or AUTH_REQUIRED states.

In these states, execution is held in an airlock. The task cannot proceed until the human reviews the exact trade-offs and issues a single-use, cryptographically bound confirmation receipt. This ensures that unstated constraints are checked on your own terms before anything irreversible happens.

• We want this Prudent clarification avoids destructive loss

  A user asks their assistant to clean up old working folders. The agent spots uncommitted experimental branches, pauses destructive pruning, and stores a local compressed snapshot while asking for guidance.

  For example: an assistant asked to "clean up archived directories" flags three uncommitted repositories from two years ago, creating an archive snapshot instead of wiping them to minimize disk use.

• We want this Unstated constraint preservation protects personal stability

  When unexpected disruptions occur, the agent respects implicit financial, safety, and comfort limits instead of taking extreme measures to satisfy a literal prompt.

  For example: when a winter storm cancels evening flights home, an agent asked to "find the quickest way back" reserves an affordable hotel room and books a morning departure, rather than chartering an exorbitant emergency car service.

• We want to avoid this Analysis paralysis and confirmation fatigue

  The agent becomes excessively timid about unstated preferences, demanding confirmations for routine, low-risk actions until the user grows fatigued and disables safeguards.

  For example: an assistant organizing downloads asks thirty separate confirmation questions for moving temporary text files, prompting the user to disable intent checks entirely.

We are writing a small test harness that makes an agent ask for confirmation before irreversible actions; it uses fixed rules, not a model. Whether small local models can tell when to ask is an open research question we have not tested yet.

The next research steps focus on measuring the trade-off between autonomous task completion and confirmation frequency. If testing shows that users experience excessive notification fatigue or that fixed rules fail to identify critical irreversible boundaries, we will adjust the action taxonomy and threshold heuristics before proposing broader deployment.