This week on CNBC, I told Andrew Ross Sorkin that organizations should absolutely audit what autonomous agents are executing behind the scenes. But visibility after the fact is only half the job. The other half is controlling what agents are allowed to do in the first place.
That is the context in which I read Dario Amodei’s recent call to pace frontier AI development. He argues for giving safeguards time to catch up rather than halting progress, and I agree with that central premise. But his essay is mostly about what frontier labs should do. Once a model is deployed inside an application, the company running it takes on a different responsibility. Labs must decide how much capability to release. Companies must decide how much authority to delegate.
No agent should be able to set or expand the limits of its own authority.
The agent can propose what should happen, while company-controlled code determines what may happen: which policies apply, who has to approve, and which credentials the action can use. Those controls also have to hold when something breaks. Production systems crash, time out, and retry. If a failure can skip an approval or rerun a rejected action, the control has a gap, and the agent does not need to misbehave to slip through it.
Say an agent rebooking a stranded employee finds a $2,000 flight, and the company approves only a $900 fare. If the airline’s system goes down mid-booking, the retry has to book the $900 flight, not the $2000 one. That is the difference between recording a decision and enforcing it.
Enforcement is where AI safety becomes a reliability problem, the kind my co-founder Maxim Fateev and I built Temporal to solve. Durable Execution carries each approval, rejection, and result through crashes and retries, and records every one. Temporal Agent Harness brings that foundation to agents. It sits around the agent SDK a developer already uses and creates a control point between the model deciding to use a tool and that tool actually running.
Temporal will not decide whether an agent’s objective is safe, write the company’s policies, or replace its security systems. Companies still own identity, permissions, and credentials. Our responsibility is the execution layer: giving developers a better way to keep agents reliable, visible, and under company control, because real people depend on the outcome.