The industry has not agreed on what AGI means, and the definition keeps moving. Something less contested is already happening, and you can watch it arrive in your inbox.
You may already have answered a message this week that no person wrote.
Software wrote it on someone's behalf, and that person may never read your response. You cannot tell whether they authorized it. You cannot tell whether the software will report your answer back to them accurately.
Today that costs you a few minutes of doubt. At volume, nobody will read closely enough to have the doubt at all.
Delegation
Agents will act for people at a scale no support team can read by hand. People will send agents to book appointments, chase refunds and argue with account systems, and companies will answer with agents of their own.
Most of what people do with institutions is form-filling and waiting, and someone who hands that to software gets back hours nobody was enjoying.
Delegation is going to become a normal way to act online. Whether it stays legitimate depends on who ends up holding the authority being delegated.
Unverified traffic
Email is the warning. Providers now judge senders on authentication and reputation, and mail that cannot authenticate does not arrive. Agent traffic will be filtered the same way, and the filters will be written by whoever receives at scale.
That outcome needs no bad intent from anyone. It follows from ordinary risk control, applied by a recipient who cannot check who authorized a message.
Portable authority
The first time this goes wrong for you, it will look ordinary. An agent you authorized cancels the wrong policy, or accepts terms you would have refused. The company holds a record of the exchange and you hold nothing. You are left arguing about your own intentions with the only party that kept a copy.
If proof of authority lives with the platform holding your account, that platform decides whose agent gets through. The proof should belong to the person, so that it travels with them.
Every delegated action should carry proof of who authorized it, and the person should hold that proof. People should be able to revoke it through the same standard, and the services relying on it should respect the revocation. A recipient should be able to check which authority an agent is using, and to decline traffic it cannot check, while still accepting agents it does not operate itself.
Existing cryptography is enough for this. The remaining work is agreement on a shared format, and that agreement is only cheap while the number of parties is small. Once the largest platforms have shipped incompatible versions, the format stops being a technical question and becomes a negotiation between companies that have already spent the money.
Our part
Ad Astra Computing builds pieces of this and publishes them. Our public agent endpoints return a signed receipt for every accepted message, issued to the person the agent acted for, so they keep their own evidence of what we received. INK, the protocol underneath, is open under Apache 2.0. Anyone can implement it, including companies that compete with us, and we cannot revoke that.
We are building it because we want it to exist when agents outnumber the people they act for.
Revision
This page will change. Every version of it stays readable, with the changes marked and dated, at the link in the signature below. If we drop one of the commitments above, the record will show the day we dropped it and what we replaced it with.