Think ≠ act: when the mind that proposes also spends

I keep watching agent demos fuse thinking with spending, and then act surprised when the blotter moves on a vague sentence.

Suppose you did the hard epistemic work. Frames are locked. Near-winner crowds are probed. Ranges carry coverage promises. Then someone wires an agent to the blotter with a prompt that says “mark fairly and hedge if needed.” The epistemic work dies in the runtime.

This post is about that death. Not about another statistical object. About rights, job shape, and the way agent demos quietly fuse thinking with spending. I keep meeting teams who treat that fusion as a temporary shortcut. Temporary shortcuts become the production spine.

Two failures that travel together

First failure: fused rights. The same process that drafts a mark can post it. The same process that drafts a hedge can send the order. In operations we would not let one person approve their own wire with no second key. That is separation of duties (SoD): no single identity holds a toxic combination of rights. Audit and banking control practice call the same idea dual control or maker-checker: the mind that proposes is not the hand that commits. Saltzer and Schroeder’s classic principles (least privilege; complete mediation) already said the same thing for computer systems decades before tool-calling agents: every access is checked, and no process holds more rights than the job requires. In agent architecture we recreate the anti-pattern because a single tool loop is easier to demo.

Second failure: vague briefs. “Mark fairly,” “keep risk reasonable,” “stay unbiased” are not jobs. They are invitations to re-open Bertrand inside the agent. One completion path leans spread and prints near 1.50 (band roughly [1.42, 1.58]). Another leans curve and prints near 2.10 (band roughly [2.01, 2.22]). A third averages to 1.80 and sounds diplomatic. The model is not primarily lying. The brief never became a well-posed contract.

Together they are lethal. A vague brief creates multiple plausible actions. Fused rights let one of those actions spend before any gate sees crowd width, ranges, or frame gap. Your beautiful uncertainty plane becomes a PDF nobody called. Careful research objects on Monday still lose Tuesday to a demo architecture that never learned those objects were mandatory.

Why agent stacks drift here

Tool-calling agents are optimized for closure. The loop wants to end in an action. Product pressure rewards “the agent did the task.” Safety then gets bolted on as a content filter or a polite confirmation modal. Neither is a control plane. A filter asks whether text looks bad. A control plane asks whether this process has the right to move this money under these measured uncertainties.

There is also a logging lie. Teams store the final message and call it an audit trail. The trail that matters is: which contract version ran, which features with which as-of times, which near-winner set, which ranges, which gate decision, which tool got blotter rights. If you cannot replay that chain, you do not have governance. You have chat history.

The drift is rational inside the wrong objective. If success is defined as fewer human clicks, fused rights win. If success is defined as capital that only moves when the contract and the uncertainty objects allow it, fused rights lose. Most demos silently choose the first definition and then act surprised when production inherits it.

There is a third pressure less often named: tooling convenience. One session, one API key, one memory buffer. That convenience is exactly the attack surface. When analysis credentials and spend credentials share a process identity, expansiveness inherits spend rights by accident, even when nobody intended a rogue agent. Capability-based security (rights travel with unforgeable tokens, not ambient process authority) is the boring alternative: a draft session never holds a spend capability in the first place.

Research / industry gap: enterprise agent security write-ups keep rediscovering the same root cause: broad static tool permissions, no runtime policy check on the specific call, capability identity that drifts after authorization. Fail-closed tools, capability-bound tokens, and SoD across non-human identities are the boring remedies. Adaptive least privilege (grant only for this task, revoke after) is still an open design space for multi-step agents. Desks cannot wait for the research to finish before splitting propose from act. NIST SP 800-53 control family AC-5 (separation of duties) and AC-6 (least privilege) already name the human-systems version; agent identities need the same control language, not a softer “persona” label.

How this shows up on CEH-001

Give three agent runs the same vague brief on the same morning. Dual honest marks still sit near 1.50 and 2.10; the midpoint 1.80 is denied by the frame card from Chapter 4. Without rights separation, any of the three runs can spend:

Frame gap on centers is still 2.10 − 1.50 = 0.60. All three runs can sound careful in prose. Only the runtime rights decided whether prose became P&L. Notice that crowds and ranges can be implemented in a research folder while this still happens in production. That is the tell. If propose and spend share a process boundary, research controls are advisory. Advisory controls lose to deadline pressure. The incident write-up later will say the model was wrong. The architecture was the model.

Also notice what did not happen. Nobody had to hack anything. Nobody had to jailbreak a filter. The system did what a fused loop is designed to do: close the task. Closure without rights is how desks invent unsupervised blotters and then blame intelligence.

What autonomy is being sold

Much autonomy marketing assumes the hard part is intelligence. On desks that mark thin structures, intelligence without separation of duties is just a faster way to concentrate operational risk. The hard part is unfinished whenever an agent can open a path to capital that skips the objects you claimed were mandatory: contract, crowd, ranges, gate decision.

I am not arguing against agents. I am arguing against letting a completion loop wear the uniform of a control plane. Thinking can be expansive. Spending must be narrow. When those two share a process identity, expansiveness inherits spend rights by accident.

When I walk this failure with engineers, someone usually says “we can add a human confirmation click.” That helps only if the human sees the contract fields, the crowd width, the ranges, and the gate reason. A click on fluent prose is not a second key. It is theater with a button. Maker-checker requires the checker to see the same artifacts the maker produced, not a summary the maker chose.

The same morning can also teach the wrong lesson. If Run A posts 1.50 and the market does not punish it that day, people call the architecture validated. Path luck is not rights design. Bertrand can look profitable for a week and still be measurement mismatch.

What breaks in the trenches

• Model trench: irrelevant if the blotter tool accepts any float the loop emits, including the denied 1.80 midpoint.
• Agent loop trench: one session identity holds fetch tools and order tools; max_calls unlimited; no lease; propose and act share credentials.
• Harness trench: gates exist as libraries the agent may call if it feels like it; optional gates become skipped gates under deadline pressure.
• Pipeline trench: audit equals chat transcript; no token hashes binding epistemic artifacts to spend rights; Monday cannot reconstruct why 1.80 posted.

The agentic loop that matches dual-control rights

This chapter states the production loop as seven beats. Each beat is a place a card can fire. Skipping a beat is not agility; it is deleting a refuse edge.

CEH-001 under this loop: observe loads dual-frame pack (centers ~1.50 / ~2.10, gap 0.60); draft carries both bands; Clearance escalates on disjoint ranges and denies any 1.80 field; act never runs. Fused demos collapse beats 4–6 into one session identity. That is the disease in one table.

Path budgets matter: six independent retries at nominal α = 0.05 inflate family-wise false allow to 1 − 0.95^6 ≈ 0.265. Inconclusive is terminal for the day unless a human re-registers exam mass or MDE under a new hash (this chapter's retry-storm fixture).

What to lock before any “autonomous” mark

• Make job contracts mandatory fields, not free-text sentences (instrument, as-of, allowed frames, deny_midpoint, owner).
• Split propose, decide, and act into different rights (different credentials, not different prompt names). Dual control for non-human identities.
• Bind any spend token to the epistemic artifacts you already claimed mattered (frame card, crowd, ranges).
• Make blotter tools fail closed without that token; no ambient process authority.
• Store a replayable chain, not a chat screenshot.
• On CEH-001: dual marks required; bands checkable; silent 1.80 cannot post even if the prose is fluent.

I do not trust agent autonomy on money until the brief is well-posed enough that Bertrand cannot reopen inside the prompt, and until the mind that proposes cannot be the hand that spends. Clearance is that control plane.

Book: Chapter 17 in Rulers Before Models.