# Delegation Difficulty Is Scoping Not Capability ## Claim Handing work to an AI agent is easy; bounding, auditing, and reversing that work is the part that stays hard. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds wherever agents act with side effects on shared or persistent state — content changes, transactions, config edits. - Weakens for read-only or sandboxed agents where blast radius is already zero, since there's nothing consequential to bound. - Doesn't claim capability problems don't exist — only that once an agent can do a task, permissioning it correctly is the harder remaining problem, not a solved afterthought. ## Evidence Identity Week's digital IAM track, per Lockie, converges on this: "being able to permission the agent so that it can do it with auditability and guardrails and policy compliance is actually really difficult." WordPress supplies the concrete failure case today — an agent given an application password "YOLOs in via WP-CLI with full access," because the platform's only current credential grants everything or nothing, with no scoped, auditable, revocable middle option. ## Links - [[AI Agent Safety MOC]] — bounding, auditing, and reversing agent work as the part that stays hard - [[Product & Startup Instincts MOC]] — where the real work sits in handing anything to an agent - [[3. Resources/Permanent Notes/Bounded Action Spaces Not Better Models Make Agents Safe to Run]] — extends: bounded action spaces are exactly the scoping mechanism this claim says is still missing for most agent-platform integrations - [[3. Resources/Permanent Notes/An Audit Trail Is Trustworthy Only When It Is a By-Product of the Work]] — applies-in: an auditable agent action needs the audit trail produced by the scoped action itself, not bolted on after - [[3. Resources/Permanent Notes/Identity Is the Control Plane in Distributed Systems]] — extends: agent permissioning is the identity-control-plane problem applied specifically to AI actors rather than human or service identities ## Tests / falsifiers - If a scoped-credential system for WordPress (or a comparable platform) ships and destructive-incident rates per agent-hour don't drop compared to full-access credentials, the claim's practical value is wrong even if the difficulty diagnosis is right. - Find an agent-platform integration where full-access-by-default has NOT produced meaningful incidents at scale — that would suggest the urgency is overstated even if the structural gap is real. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Full Document Contents/Articles/The Growth of Domain Names and the Future of AI in Internet Identity]] — Lockie's Identity Week takeaway and the WordPress application-password example.