# Bounded Agents Earn Broader Authority Through Verified Runs ## Claim An AI agent should receive broader access or authority only after bounded, scoped runs repeatedly satisfy explicit acceptance checks — not on the strength of a demo, a plausible plan, or its own completion report. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds for workflows with observable outcomes and reversible actions, where a real acceptance check (not just "it ran without erroring") can be defined and applied repeatedly. - Does not establish which specific scope-expansion schedule is correct — only that expansion should be earned through verified repetition, not granted upfront on capability claims. - Breaks down for emergency response or ambiguous judgment calls, where the premise of iterative bounded piloting doesn't apply and tighter human control is needed regardless of prior track record. ## Evidence A walkthrough of building automations with Claude Cowork demonstrates two concrete containment mechanisms — folder scoping ("It only has access to what's in that folder. Nothing else on your computer") and a dedicated adversarial-review skill tasked with finding "loopholes, mistakes, and gaps" in a plan before it runs — and recommends starting with one bounded workflow, reviewing its plan, and only widening scope after repeatable results. The video does not demonstrate an equivalent containment mechanism for remote connector permissions, which is a real gap in the pattern as shown. ## Links - [[3. Resources/Permanent Notes/Verification Must Test the Claimed State Not Only the Latest Change]] — because extends; both distrust an agent's own account of success — one at the level of a single completion claim, this one at the level of "should this agent get more access" - [[3. Resources/Permanent Notes/Reversible-by-Default Is What Makes Bulk AI Edits Trustworthy]] — because applies-in; reversibility is one of the preconditions this note's scope section names for the bounded-piloting pattern to be safe to run at all - [[3. Resources/MOCs/AI Agent Safety MOC]] — because applies-in; this is a general access-control pattern for agentic systems, not a Cowork-specific quirk - [[3. Resources/Permanent Notes/A Capability Demonstration Is Not an Operating Model]] — because contrasts: this note is the constructive alternative — authority expanding on accumulated verified operation instead of on a single demonstration. ## Tests / falsifiers - Find a case where an agent was expanded to broader scope purely on the strength of a compelling demo or plan review, with no repeated bounded-run verification, and it later failed in a way bounded piloting would have caught — that supports the claim. - Find a case where bounded piloting was followed rigorously and the agent still failed unpredictably once scope expanded — that would suggest verified repetition at narrow scope doesn't actually predict safety at wider scope, weakening the claim. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/How to Build AI Automations With Claude Cowork]] — YouTube, "How to Build AI Automations With Claude Cowork." https://www.youtube.com/watch?v=CEDy6rN4t_w