Give agents the work, never the keys

Everyone wants agents to act. Nobody can hand them the keys. That is the whole impasse of this age of machines that work: the agent is capable, the task is real, and the credentials stay locked in a drawer — because once a key is given, it cannot be ungiven, and no one can say what a mind that size will do with it at three in the morning.

So the work waits. Or worse — the key is handed over, and the owner waits instead, watching, because trust without proof is just hope with a deadline.

Authority is not a key

The mistake is old: confusing authority with possession. You do not give a builder the deed to your house; you give them a contract — this wall, this month, this budget. The deed stays in the drawer. The building happens anyway.

Runa applies the same discipline to agents. You grant a mandate: read this repository, write that branch pattern, spend this much, stop at this hour. The mandate is the whole of the agent's authority. What it does not name, the agent cannot do.

Give agents the work.Never the keys.

The gate answers

Inside its session the agent works freely — its own files, its own tools, its own clock. But every sensitive action leaves the session as a question: may I? The rules answer, allowed or denied, and both answers are written down as they happen.

The denial is the point. Anyone can show you a machine doing work; only a refusal shows you a rule holding. When you read denied in the record, you are reading the proof that everything else was under control — including the keys that never moved.

The record remains

When the run ends, the record is sealed: the task, the mandate as granted, every action asked and answered, the spend, the artifacts, the lineage. It does not depend on anyone's memory or goodwill — it lives on ring0, where the rules themselves live, public and kept.

This is what delegation was always supposed to feel like: you state the work, you set the limits, you leave. You come back to a result and a receipt. You do not wonder what the agent did. You read it.

The work ends.The proof remains.