Hypothesis Working with AI · 1 min read
Whose name is on the decision?
A trail of AI-assisted work is only useful if it names the person who decided, and if we know whose rights the agent used.
Photo: Gabrielle Henderson on Unsplash
After the workshop I wrote about in Green is not done, two questions stayed with me.
Who decided?
When a team works with an AI tool, usually one person drives it while the others discuss. It is then easy for the record to name the person at the keyboard instead of the person who made the call.
That sounds small, but a trail of decisions is only useful if it names the right person. "The team" is not an owner, and neither is whoever happened to type.
With whose rights?
Colleagues who use AI agents every day pointed out something simple: an agent works with your credentials. Whatever you are allowed to do, it can do too. Rules in a project file help, but they are not a sandbox.
Photo: Maria Ziegler on Unsplash
OWASP calls this excessive agency: more rights or freedom than the task needs. The advice is not new: give the least rights you can, and keep a person in the loop for anything with real impact.
What I ask now
When I hear "we use AI, but everything is traceable", I want to ask two things:
- Does the record show who decided, or only who typed?
- Whose rights did the agent use?
I do not have full answers yet. That is why this is a note.
Found a mistake?
Report it the way you would in a sprint. Fixes are logged here.
Corrections
None yet.
