Vision
People should be able to see what AI does for them, and have a say in its rules.
AI software has started acting for people. It pays bills, fills in forms and negotiates prices. We are a small research foundation in Ottawa working on the rules and tools that keep those actions visible, and accountable to the people they affect.
Until recently, anything that acted on your behalf was a person: a clerk, a lawyer or a broker. You could ask what they did. If they worked against you, you could fire them, and the law gave you ways to hold them to account.
Software agents now do some of that work, and they will do much more. Since 2019, the length of task an AI agent can finish on its own has roughly doubled every seven months.1 The rules we use for human representatives don't exist for software yet. Today, most agents:
- leave no record you can check of what they did, or for whom;
- answer to the company that runs them, which may not be you;
- hold permissions that never expire unless someone remembers to remove them;
- run on computing owned by a handful of firms.2
We think each of these can be fixed, and that fixing them is easier now than after the contracts and habits have set.
What we propose
Five proposals. Each is a working idea with known weak spots, and we publish the weak spots.
1. A receipt for every agent action. When an agent acts for you, it should leave a signed record of who it acted for, what it was allowed to do and what it actually did. Copies are kept in several independent places, so no single party can rewrite the history. Read the essay.
2. Assistants with a duty of loyalty. Your assistant should be bound to you the way a lawyer is bound to a client: no hidden commissions, and no second master. In practice that means running on hardware you control where possible, and sharing only the minimum fact a task needs instead of your files. Read the essay.
3. Permissions that expire. An agent should get the narrowest permission a task needs, for a limited time. You should be able to take back any single permission without shutting everything else down. Read the essay.
4. A separate channel for agent traffic. More than half of web traffic is already automated.3 We propose that agents talk to services and to each other over channels where every message is signed and tied to an accountable owner. Forums, reviews and inboxes meant for people would then stay usable by people. The hard part, which we haven't solved, is making unsigned bots worse off than signed ones. Read the essay.
5. Public computing. A few companies train the largest models and everyone else rents access. Compute and evaluation tools for public-interest work, such as clinics, schools, researchers and municipalities, should be available on public terms, the way libraries and weather data are. Read the essay.
What would change
- A medical bill. Your assistant checks each billing code against the published rules on your own device. It shows which charges look duplicated and cites the rule. Your records never leave the device. How it works.
- Small shops buying together. Twenty independent clinics pool a supply order to reach wholesale prices without showing each other their volumes. How it works.
- A public consultation. Residents prove they live in the area without handing over ID. Each one spreads a fixed budget of votes across the issues they care about, so officials see how strongly people feel, and a flood of bot submissions counts for nothing. How it works.
What we actually do
- Research notes and draft specifications for each proposal, in plain language with a technical appendix. See Research.
- Simulations that test the proposals, with the failures published alongside the results. See Labs.
- Shared Horizon maps concrete next steps for over three hundred organisations: labs, procurement offices, hospitals, standards bodies.
- The Observatory tracks compute concentration, agent autonomy and institutional readiness, and scores our own forecasts against what happens.
- Nineteen floor principles: limits our designs must respect regardless of what a vote or an optimiser prefers.
What we haven't solved
- How to prove an agent didn't keep a second, hidden set of books.
- How to verify that someone is a real, local person without building a surveillance system.
- How a small assistant on your phone holds its own against a much larger model working for the other side.
- How people keep a livelihood as AI takes over routine work. We have early ideas about recognising contribution without turning it into a currency. We don't have an answer.
The full list, with what would help, is in Open problems.
1. Thomas Kwa, Ben West et al. (METR), Measuring AI Ability to Complete Long Software Tasks (March 2025), arxiv.org/abs/2503.14499.
2. Ben Cottier et al., Epoch AI, The rising costs of training frontier AI models (2024), arxiv.org/abs/2405.21015; Stanford HAI, AI Index Report 2025, hai.stanford.edu/ai-index.
3. Imperva (Thales), 2025 Bad Bot Report (April 2025): 51 percent of 2024 web traffic was automated. imperva.com.