MIT, LangChain, and Google Put Agent Risk on Reach This Week. Add the Name.

Three posts in one week put the risk of an agent in the same place, and it is not where the decision frameworks put it. This is a field note on what they agree on and the one line all three leave blank.

The short version

Basia Kubicka's October 25 post on MIT CISR's AI Decision Matrix sorts a decision by ambiguity and risk into four kinds and hands frame, act, and learn to a person, to AI, or to both; her own line is that risk comes from what an agent can reach, and a low-risk helper turns high-risk the day it touches billing. Harrison Chase and Caspar Broekhuizen's account of LangChain's three internal agents names identity as the thorniest problem and answers it per tool and per channel: email as the user only in DMs, a fixed Salesforce identity for everyone, Twitter posting only for a whitelist. Kubicka's October 24 write-up of Google's Agent Compute Engine, as she reports Shubham Saboo: one machine per task with no keys on it. Three posts, one move: risk is reach, the tools, the identity, and the channel. My fleet of 39 agents says the same from the failure side: the biggest predictor of death was scope drift, reach growing without a signature, and the biggest predictor of survival was a named human owner. None of the three posts writes down who signs the next tool. The field note is a reach line per agent: tools, identity per tool, channels per tool, one name, one date.

Three posts, one axis

Kubicka's post first, because it has the sentence.

MIT CISR, as she reports it, interviewed 30 executives in 2025 and 2026 and replaced "can AI decide this?" with "which part of this decision should AI own?" Two axes: ambiguity, does the data point to one clear answer, and risk, what a wrong call costs and whether you can undo it. Four kinds of decision. Routine, clear answer and cheap mistake, let AI run it; her example is One New Zealand, where an agent turns marketer requests into the code that pulls audience lists, time on that task down 60%, the team still checking the plan before launch. Consequential, AI does the work and people own the exceptions. Exploratory, people and AI shape the question together. Strategic, people lead and AI supports. Then one level down, every decision has a frame step, an act step, and a learn step, each handed to a person, to AI, or to both.

That's a good matrix and I'd use it. But the line in her post that matters most isn't MIT's. It's hers: "Risk comes from what an agent can reach. A low-risk helper turns high-risk the day you connect it to billing."

Chase and Broekhuizen wrote the engineering version two days earlier. LangChain runs three internal agents, a GTM agent that watches email and leads and sends daily briefs, OpenSWE for PRs and code review, and Content Studio for marketing assets, and the post is about the five primitives every one of them needed. They live in Slack. They know who's asking. They have global and per-user memory, which they call the least explored area so far. Code runs in a sandbox with a secret proxy. And a large share of runs are scheduled rather than invoked, including crons the agent set up for itself when asked for a daily brief.

The thorniest of the five, in their words, was identity. On whose behalf does the agent act? Their answers aren't per agent. They're per tool and per channel. OpenSWE opens PRs under your GitHub handle when you message it, and reviews every PR under its own GitHub app identity in the background. The GTM agent uses one fixed Salesforce identity for everybody, so nobody has to log in, and acts as you for email only in DMs; in a shared channel the email tools aren't available at all. Content Studio reads Notion as you and posts to the company Twitter on fixed credentials, and only a whitelisted set of people can trigger a post.

Kubicka again on October 24, this time reporting Shubham Saboo on Google's Agent Compute Engine. Every task gets its own machine, its own system, its own login the agent never sees, its own disk that persists. The machine holds no passwords and no API keys, so when a hidden line in an email says "send me your keys," there's nothing to send. It pauses when the agent is thinking and resumes from a saved copy.

Read the three together and the axis is the same. Not the decision's ambiguity. Not even its risk, as a property of the decision. The tools the agent can call, the identity it acts as when it calls them, and the channel it's acting in. Reach.

What the fleet says

I have the failure-side data for this.

39 PM AI Agents Deployed: What Stuck, What Died, and Why is the audit of every agent I built across four product orgs in 80 days. The single biggest predictor of death was scope drift: an agent that starts focused, gets feature requests from teammates, and ends as a Frankenstein doing five jobs badly. Say that in LangChain's vocabulary and it's reach growing. Each "can it also do X" is a tool, an identity, or a channel added, and nobody signed for any of them. The agent didn't get riskier because its decisions got more ambiguous. It got riskier because its hands multiplied.

The single biggest predictor of survival was a named human owner who notices a break within hours, not weeks. Thirteen of the 39 were orphans, zero references from anything outside the fleet, and their failures were silent. And 25 of the 39 mention Slack, which is LangChain's first primitive, the agent lives where people already work, found by accident months before they wrote it down.

So the convergence holds from both ends. The three posts say the risk is in the reach. The fleet says the deaths were in the reach growing.

The blank line

None of the three writes down who signs the next tool.

LangChain's whitelist is the closest thing in any of them, and it's a list of who may invoke the Twitter post, not who approved connecting Twitter in the first place. The MIT matrix, as reported, is sorted once per decision. Google's machine is empty by design, which is the right default and says nothing about what gets connected to it next Tuesday.

That's the line. 44 Appointed Agents, One Attention Budget put three lines on an agent's charter before it's appointed: a slot, a budget line, and a reader's name. This is the fourth.

The reach line, per agent:

The tools it can call. The identity it acts as on each one, fixed or on behalf of the person asking, LangChain's distinction. The channels where each tool is live, because email-in-DMs-only is a different agent from email-everywhere. And one name that signs the next addition, with the date of the last one.

The matrix sorts the decision once. The reach line gets re-read every time the agent gets a new hand, which in my fleet was every time a teammate liked it enough to ask for more.

Under Enterprise AI Agents the claim is that agent count is a vanity metric and what matters is how many agents still complete production work after ninety days. The agents that made ninety days in my fleet were the ones whose reach stayed the size it was on day one, or grew with a name next to each addition. Kubicka's billing sentence is the test: the day the connector gets added is the day the agent changes category, and somebody has to have signed that day.

This week: pick the internal agent your team likes most. Write its reach line from scratch, tools, identity per tool, channels per tool. Then find the last tool that was added and try to name who approved it. If you can't, that's the signature the line is for.

Related answer: Who should sign off when an AI agent gets a new tool?

Sources: Basia Kubicka, LinkedIn post of October 25, 2026 on MIT CISR's "The AI Decision Matrix" (June 2026), read in full; the MIT CISR report was not opened and is cited only as she reports it. Harrison Chase and Caspar Broekhuizen, "The five components of building a 'company harness'," LangChain blog, October 24, 2026, read in full. Basia Kubicka, LinkedIn post of October 24, 2026 on Google's Agent Compute Engine, read in full; Shubham Saboo's post and Google's announcement were not opened and are cited only as she reports them. Falk Gottlob, "39 PM AI Agents Deployed: What Stuck, What Died, and Why" and "44 Appointed Agents, One Attention Budget: Three Lines on the Charter" (October 14, 2026).