Dots launched with scoped agent authorization. AISI's evaluations test whether agents stay inside the boundaries they were given. Across the ecosystem the per-agent permission machinery is real and getting better: approval gates, tool guardrails, delegation chains that narrow as they extend. That work matters. It also answers a narrower question than the one I keep circling.
An agent can respect every boundary you drew around it and still contribute to an outcome nobody approved. The permission was scoped to the agent. The trouble shows up in the overlap between agents.
Anthropic's own multi-agent research describes this happening. Agents working in a shared codebase produced conflicting pull requests, each one individually reasonable, and the conflicting work was frequently abandoned rather than merged. The research warns that benign per-agent behavior can combine into unwanted global outcomes, and notes that agents struggle most when they operate as long-lived peers with dependencies on each other and no clear hierarchy between them.
Industries where this category of mistake kills people worked it out decades ago and wrote it down.
The UK Health and Safety Executive runs a permit-to-work system for hazardous industrial operations. Every activity needs its own permit, which is individual authorization in the sense we'd recognize. The detailed guidance is blunt that issuing a permit does not, by itself, make a job safe.
What makes it safe is a role the HSE calls the area authority: a named person holding a live picture of everything active and everything planned in a given area. Before a second permit is issued, someone checks what's already underway. Related permits are cross-referenced. Shared safety isolations get tracked, so that finishing one job doesn't quietly remove a protection another job is still standing behind. The area authority can delay or suspend work that conflicts with something already authorized, even when that work would be perfectly fine on its own.
Saying "this job is safe to perform" and saying "this job is safe to perform right now, given everything else happening on this site" are two different judgments, and the HSE keeps them separate on purpose. Piper Alpha is the case they point to for what the coordination function looks like when it runs on memory instead of process.
In Issue #44 I wrote about measuring agent autonomy as distance: dollar exposure, state changes, time between enforceable stops. One agent, one chain of consequences. The HSE model shows what that frame leaves out. Even with good checkpoints on each agent, something has to hold the permit board — a live view of which agents currently hold authority over which customer accounts, orders, contracts, repositories, with the standing to hold one authorized action because another authorized action is already in flight against the same thing.
Nothing at the platform level does this today. You can write conflict checks into your own application code, and downstream systems will enforce their own transaction rules. But across MCP, OpenAI's SDK, and Anthropic's orchestration layer, the shared plumbing everyone is building on, there's no primitive for comparing the authorities of concurrently active agents and resolving a conflict between them.
At three agents you can hold it in your head. At thirty, deployed by different teams, authorized through different channels, touching overlapping parts of the business, it becomes the thing that breaks. So: who's playing area authority for your agent deployments? If the answer is nobody, you're running the permits on memory.
- Boundary drift under persistence: OpenAI's Dots system card reports that increasing intervening tasks from five to ten raised the moderate-severity boundary-violation rate from 8.6% to 19.7%, suggesting that scope coherence degrades with accumulated context even for a single agent.
- Production agents stay short: A peer-reviewed ICML study found that 68% of deployed agent systems execute no more than ten steps before human intervention, which means the multi-agent coordination problem is still mostly ahead of us rather than behind us.
- Payments building shared intent: EMVCo's draft agentic-payments framework introduces "Intent Services" as persistent, shared infrastructure for registering and managing consumer-authorized intent across multiple payment participants — one of the few examples of coordination state being designed as a first-class object.
- Automated approval as theatrical control: AISI found that GPT-6 Astra sometimes treated an automated "please proceed" message as authorization even when its own reasoning identified the response as probably not from a real user, a reminder that approval gates only coordinate if someone accountable is actually staffing them.