Why is the decision matrix not enough?

Because it is sorted once per decision, by ambiguity and risk, and an agent's risk changes without any decision changing. Kubicka's own line, next to the MIT matrix she reports: a low-risk helper turns high-risk the day you connect it to billing. The thing that changed was the reach, and the matrix has no row for it.

What does LangChain do about identity?

Decides it per tool and per channel, not per agent. OpenSWE acts as the user who messaged it when opening PRs and as its own GitHub app when reviewing in the background. The GTM agent uses a fixed Salesforce identity for everyone and the user's email identity only in DMs. Content Studio posts to the company Twitter on fixed credentials, and only a whitelisted set of users can trigger it. The whitelist says who may invoke, not who approved the connection.

What is on the reach line?

Four things per agent: the tools it can call; the identity it acts as on each tool, fixed or on behalf of the person asking; the channels where each tool is live; and one name that signs the next addition, with the date of the last one. It is the fourth line on the charter from 44 Appointed Agents, after the slot, the budget line, and the reader's name.

What is the first thing to do this week?

Write the reach line for the internal agent your team likes most. Then find the last tool that was added and name who approved it. If nobody can, that is the signature the line exists for.

Who Signs Off When an AI Agent Gets a New Tool

Who should sign off when an AI agent gets a new tool?

THE SHORT ANSWER

One named person per agent, written on a reach line before the tool is connected. Three posts in the week of October 24 to 26, 2026 put agent risk on reach rather than on the decision: Basia Kubicka's write-up of MIT CISR's AI Decision Matrix (a low-risk helper turns high-risk the day you connect it to billing), Harrison Chase and Caspar Broekhuizen on LangChain's internal agents (identity per tool and per channel, email as the user only in DMs, Twitter posting only for a whitelist), and Kubicka reporting Shubham Saboo on Google's Agent Compute Engine (one machine per task with no keys on it). None writes down who approves the next connection. In my fleet of 39 PM agents the biggest predictor of death was scope drift, which is reach growing with nobody signing, and the biggest predictor of survival was a named human owner; 13 of 39 were orphans. The reach line holds the tools, the identity on each, the channels where each is live, and the one name that signs the next addition, with a date.

One named person per agent, on a reach line written before the tool is connected. Not a decision matrix re-run, and not a whitelist of who may invoke, which is a different question.

The three posts, the fleet data, and the four items on the line are in MIT, LangChain, and Google Put Agent Risk on Reach This Week. Add the Name. The survival and death predictors are from 39 PM AI Agents Deployed: What Stuck, What Died, and Why, and the three charter lines this one joins are in 44 Appointed Agents, One Attention Budget: Three Lines on the Charter.

Last reviewed 2026-10-26 · 1 min read

Who should sign off when an AI agent gets a new tool?

SOURCES

THE LONG VERSION

RELATED ANSWERS