The Agent Bottleneck Isn't the Model. It's Permission.

Bottom line: Your agent's model is already good enough to draft the itinerary, stage the refund, or propose who spoke in the meeting. What still breaks is the door. Last week Sierra and Meta, with Shopify, Stripe, Walmart and others, put a name on that door: Personal Agent Protocol. In the same week, TypeSafe AI raised $870M at a $7.5B valuation for Jev, a model that doesn't write sentences. It returns decisions. If you're a CEO or CHRO still shopping for "smarter chat," you're solving last year's problem. The job now is authority: who gets in, what they may prepare, and which decisions must stay typed and logged.

This is a sequel to The Agent Stop Line Playbook. That post said to publish three buckets: Prepare, Propose+wait, Never. This one covers the two forces that just made that policy unavoidable: permission at the perimeter, and decision models inside the workflow.

What changed

Three signals landed within days. Treat them as operating context, not FOMO.

1. The web is writing agent access rules

I put it bluntly on X: your AI agent can book the flight, but the airline's website won't let it in. Personal Agent Protocol ("Poppy") was announced on 6 October by Sierra and Meta with Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart. A draft followed on 9 October with 35 more design partners, including OpenAI, Visa, PayPal and Okta. It's an open protocol, built on OAuth, for how a company declares what personal agents may do: whether they can work as a guest, how the user signs in, and what access they get.

The overview names the failure it's trying to kill: all or nothing. Either the agent passes as the user and clicks through pages built for people, or the company blocks it outright. The protocol's own example is the one every operator should steal: let any agent search flights, let signed-in agents see the user's trips, and require the user's approval before buying a ticket.

That's the stop-line problem, moved from your Slack channel to the public internet. Users decide what their agent may hold. Companies decide what it may do. An optional operations extension has the user approve the exact terms of a consequential action (an exchange, a booking change, a cancellation) before the company performs it, and performs it at most once. It's a draft and will change. But if you sell anything online, this isn't a developer curiosity. It's your next identity-and-payments conversation with your CISO and your head of CX.

2. The next AI doesn't chat. It decides.

TechCrunch reported that TypeSafe AI raised $870 million at a $7.5 billion valuation, led by Andreessen Horowitz with Sequoia and DCVC, weeks after Jev's 15 September release. Jev isn't an LLM. It doesn't output prose. It returns what TypeSafe calls calibrated decisions: choices, scores and probabilities that software can consume directly. Fortune reported that OpenAI shipped a competing Decisions API on 6 October, about three weeks after Jev launched.

ChatGPT talks. The useful layer underneath your agents increasingly just decides: approve or escalate, this person or unresolved, route here or there. That's an architecture change, not a vendor preference. Generation stays with the model that writes. Authority moves into components that can't produce a sentence, which also means they can't invent a name, a vendor, or a "yes" that wasn't on the list.

3. Generation got cheap. Credibility didn't.

On 6 October OpenAI posted more than 700 AI-generated maths preprints to GitHub, covering hundreds of problems, and Nature reported mathematicians "up in arms." Within a day it withdrew three for an error. Only part of the collection has Lean formalizations, and a Lean proof only checks the statement as written in code, not necessarily the claim made in English. The same week, Google DeepMind took the slower route: its AlphaProof Nexus results on open Erdős problems were published in Science after peer review.

Publishing is going through the same reckoning. WIRED reported that HarperCollins staff were "voluntold" to become "AI Champions" after leadership bought licences it didn't know how to deploy. When employees raised legal, ethical and environmental concerns, they were told it was "the cost of doing business." Earlier this year Hachette pulled a novel over suspected AI use.

None of that is anti-AI. It's anti-unaccountable output. Volume isn't scarce anymore. A named human, a logged decision and a way to undo it are.

What this means inside a company

If you run people or a P&L, turn the headlines into three questions for Monday.

Question 1: Where do agents hit our doors?

List every place an agent can pose as a customer or employee: website, helpdesk, payments, SSO, MCP connectors, browser agents. For each door, write one line: anonymous OK, signed-in read, signed-in write, or human confirmation required. Personal Agent Protocol is one industry version of that list. Your internal stop line is the other. They should match.

Question 2: Which steps are decisions, not drafts?

Most "AI projects" still mean more chat. Pull out the steps that are really binary or limited to a fixed list: match this speaker to the org chart or mark them unresolved; approve this refund tier or escalate; allow this tool call or block it. Those are jobs for a decision model. Put generation beside them, not on top of them. A model that has to pick from a roster and is allowed to choose "none" is structurally safer than one that writes a confident paragraph.

Question 3: How do we stay credible when volume spikes?

If an agent can draft 50 vendor emails or 50 attribution labels in an hour, who signs off on the first real one? Where does the log live? How do you undo a wrong yes? If you can't answer all three, you don't have automation. You have a future incident with better grammar.

A concrete pattern from our own build

In a product we're building, we've been working on speaker resolution and authority weighting for meeting memory. The load-bearing rule is simple: never fabricate attribution. A deterministic matcher handles clean email and exact-name matches. Anything ambiguous (nicknames, initials, two plausible people) goes to a Jev-backed choice over a candidate roster that always includes "none of these." Unresolved is a first-class outcome. Guessing isn't.

We verified that path on a feature branch with a live Jev call in the resolver (model jev-1.13.0 in the verification notes). I'm not claiming the whole product has been rebuilt around decision models. I'm claiming that when the risk is a silent wrong name in org memory, chat is the wrong tool. Permission and calibrated choice are the right ones.

Meta built the same lesson into Muse. In its safety write-up, the agent proposes actions, but only a separate component called Sentinel can grant permission, and the agent can't override it. Separate the worker that proposes from the gate that permits. Personal Agent Protocol applies that lesson to the consumer web. Stop-line policy applies it to your company. Decision models apply it to the steps inside the agent that should never free-text their way into a lie.

A one-page board framing

You don't need to adopt every protocol logo. You do need all four rows.

CEO + CHRO moves for the next 21 days

Days	Owner	Action	Done when
0–7	CISO + CX + Product	Map the external doors agents already hit (web, support, payments)	One spreadsheet: door → current posture
0–7	CHRO + CEO	Republish the stop-line buckets against that map	The Propose+wait list includes customer actions taken through agents
7–14	Eng / Platform	Flag workflow steps that are decisions, not drafts	At least three steps marked for roster/choice design
7–14	Legal + Security	Set a position on personal-agent protocols and on consumer agents touching company data	A written allow / ban / SSO-only list
14–21	CEO	Pick one pilot where "unresolved" beats a guess	Pilot ships with an explicit "unresolved" path and an audit log

Forward the table. Don't wait for an offsite. The internet's gatekeepers are already writing their rules.

What not to do

• Don't buy another chatbot and call it governance.
• Don't let "AI Champions" turn into unpaid change management with no stop line. That's how legitimate objections get waved off as "the cost of doing business."
• Don't mistake a Lean checkmark, a watermark or a viral demo for board-grade credibility. Volume is cheap. Named accountability isn't.
• Don't promote an agent from Prepare to Propose+wait because the model got smarter. Promote it when the permission path and the decision path are boring enough to audit.

Bottom line, again

Models will keep getting better. That isn't the scarce resource.

Permission is scarce. Calibrated decisions are scarce. Credibility after a wrong yes is scarce.

Publish the door rules. Put decision models on the steps that must not invent. Keep generation for drafting. Then let the agents work, inside a building whose locks you can explain to a board on one page.

References

• Personal Agent Protocol: overview, operations extension, Sierra draft post, CNBC launch coverage
• Jev: TechCrunch on the $7.5B round, Fortune on Jev and OpenAI's Decisions API
• Maths: Nature on OpenAI's 700 preprints, DeepMind's AlphaProof Nexus in Science
• Publishing: WIRED on publishers' AI use, The Guardian on Hachette's Shy Girl
• Meta AI Research: How We Built Safety Into Muse
• Related on X: permission bottleneck, Jev decides, credibility vs cheap breakthroughs
• Related posts: The Agent Stop Line Playbook, The Age of Proactive AI

---

Want this in front of your exec team? I run board-ready permission and stop-line workshops. Book a talk or a private briefing. Prefer a quick self-check first? Take the free AI Readiness Scorecard. More operator notes on the blog.