Why an AI agent should ask before it acts

A chatbot answers questions. An AI agent also does things: it can run a command, edit a file, open a web page, or schedule work to happen later. That is what makes agents useful, and it is also why a wrong move costs more. A bad answer can be ignored. A bad command may already have run. For the difference in detail, see AI agents vs. chatbots.

These are the principles behind the NAMELESS agent workspace, and the ones we would look for in any agent you let near your files or accounts.

Approve the exact action, not a general permission

"Allow this agent to use the terminal" is too broad. What you are really deciding is whether this specific command, with these arguments, should run. In the NAMELESS workspace, shell commands, desktop control, agent-created schedules, and writes to a connected device wait for your approval, and the approval is attached to that saved call and its arguments. If you reject it, the agent is told so and is instructed not to attempt the same thing another way. Any other risky step still waits for its own approval.

Reading is treated differently. Looking at a file or a public web page does not change anything, so those steps proceed without a prompt. The line is whether an action can change something.

Enforce the rules where the model cannot talk its way around them

A model can write "I asked for your permission" without having done so. Text is not an approval. In NAMELESS, ownership, approvals, capabilities, and the leases that let a connected device claim a job are checked on the backend, not in the model's wording and not in the browser. A request that does not pass those checks does not run, however the model phrases it.

Do not retry when you are not sure

Connections drop. If an agent sends a command to your computer and never hears back, it cannot know whether the command ran. Running it again could install something twice, or delete the wrong thing twice. NAMELESS reports an uncertain or expired execution as a failure and asks you to check before approving a retry, rather than running it again automatically.

Keep secrets out of reach

An agent works for you, so it should hold as little of your credentials as it can. Pairing tokens are scoped to one device. Cookie values are not requested by default, and sharing them takes both an approved request and a local opt-in on the device. Commands run with a reduced set of environment variables, so the token that pairs a device is not handed to the commands it runs.

Be honest about what a safeguard is

Path checks and a trimmed environment reduce mistakes. They are not an operating-system sandbox. A command you approve still runs with the permissions of the account that started it. If you want a stronger boundary, run the connected device in a dedicated virtual machine or a separate account, and treat everything in it as reachable by the agent.

What this means for you

• Read the arguments before you approve; they are the actual action.
• Start with a throwaway folder or virtual machine until you trust the setup.
• Prefer approving one step at a time over granting broad permissions.
• If an agent cannot tell you what it did, assume nothing happened and check.

Where this stands

The NAMELESS agent workspace is for accepted early-access accounts, and it depends on a connected model service. The NAMELESS model itself is still in training. This post describes what the workspace is designed to enforce; it makes no claim beyond that.

You can join the waitlist to follow progress, or read about the thinking behind the model in what a context window is.