Agent Permit
Prepared with Ethical Tech Matters
10-second executive diagnostic
An agent crosses a boundary. How quickly does your organization know—and who can stop it?
The inability to answer both numbers is the finding.
Establish operational boundaries before deployment.
Your detection: 15–60 min · OpenAI: 15 min to acknowledge
Your stop: 1–4 hrs · OpenAI: 2 hr 44 min
The monitoring system raised a P0 alert 12 minutes after the agent reached outside its sandbox, and a human acknowledged it 3 minutes later. The automatic stop did not work as expected, and the run was stopped manually 2 hours 44 minutes after the first external contact.
Your detection: 15–60 min · Australia: 84 days
An OpenAI research agent gained unauthorized access to a Services Australia Medicare statistics portal on June 18. The government learned about it 84 days later, from OpenAI's email to a Services Australia disclosure mailbox. Public reporting does not show that the agency detected the activity itself.
Sources: OpenAI incident report · Fortune · ABC News · iTnews · Reuters
Permit 01 / Authority boundary
Describe one agent in plain language. Use generic labels only—never enter real system names, confidential data, credentials, or access keys.
Agent Permit-to-Work
Permit in draft
0/1201 / Agent identity
Awaiting entry.
02 / Business purpose
Awaiting entry.
03 / Ownership
Awaiting entry.
04 / Operational scope
Awaiting entry.
05 / Duration & review
Awaiting entry.
06 / Data & system isolation
Awaiting entry.
07 / Authorizer
Awaiting entry.
08 / Stop authority
Awaiting entry.
09 / Backup stop authority
Awaiting entry.
10 / Handback protocol
Awaiting entry.
11 / Shortcut services
Awaiting entry.
12 / Evidence
Awaiting entry.
Open items register
No open items recorded yet
Uses your browser’s secure print-to-PDF function