30 audited platforms ask what an agent can do, not what it shares

On October 22, researchers publishing an audit of 30 agent platforms found a consistent gap: the permissions screen showed up, the human granted access, and the conversation ended there. No screen ever asked what the agent could share from that access. The human had handed over a key and walked away without knowing which doors the agent would open on the way out.

The same day, a separate arXiv paper described a framework that locks agent promises at the moment the human sets them, refusing any action the human did not explicitly pre-authorize. Read alongside the audit, the contrast is precise: one body of work shows how few products capture the human's full intent at grant time; the other shows what a product looks like when it takes that intent seriously. The audit's 30 platforms treat "I granted access" and "I trust it was used correctly" as the same statement. They are not. The arXiv framework treats them as two separate moments that each require design.

A third note from October 21 sharpens the stakes. Gaze-tracking research found that humans in approval screens looked at the content, said yes, and missed the mistake anyway. If presence in a review step does not equal judgment, then a permissions screen that asks one question instead of two is worse than it looks: the human who already struggles to catch what an agent does is also never asked to constrain what the agent tells others. The audit's finding is not that 30 platforms lack a feature. It is that 30 platforms hand the human one side of a conversation and call it consent.

The live-chat study published the same day adds a runtime dimension. Adding agents between a human and an answer made quality drop. Each extra handoff introduced cost. The permissions gap compounds this: when an agent hands work to another agent, the sharing question the human was never asked at grant time now governs a chain of transfers the human cannot see. The human set one term; the chain applied it to a situation the human did not imagine.

Design the permissions screen in two passes. The first pass captures what the agent may do, the access most products already ask about. The second pass captures what the agent may share, and with whom, and under what conditions. Present the second pass at the same moment as the first, before the agent runs, so the human's intent is whole before any action is taken. Then surface a readable record of what was actually shared, distinct from what was accessed, so the human can compare the two after the fact. The audit found 30 platforms that skipped the second pass entirely. Yours does not have to.