The UN Security Council Is Debating Agents Today. You Still Have To Decide What Yours Can Touch.

Today, in a room in New York, Sam Altman sat down in front of the fifteen members of the United Nations Security Council. Dario Amodei joined remotely. Yoshua Bengio was there as co-chair of the UN's Independent International Scientific Panel on AI, and Clement Delangue came from Hugging Face. French foreign minister Jean-Noel Barrot chaired it. Chinese developers, DeepSeek among them, were invited to the same table. The agenda item was "maintenance of international peace and security", which is the phrase the Council usually reserves for wars.

France's concept note, circulated to members in advance, frames the session around two things: the malicious use of AI, and the possibility that humans lose control of increasingly capable systems. It raises autonomous systems attacking critical infrastructure. It raises recursive self-improvement. It asks four questions, the sharpest of which is how evaluation and verification can possibly keep pace with the technology.

The Council has discussed AI before, half a dozen times. This is the first session focused on loss of control rather than opportunity, and the first time frontier developers from the United States and China have been seated together in that chamber over a shared safety concern. No resolution was expected. It was an open briefing.

What the Council can and cannot do

Here is the part worth being honest about. The Security Council has no mechanism to regulate a model. The two UN bodies that exist for this, the Independent International Scientific Panel on AI and the Global Dialogue on AI Governance, were created by General Assembly resolution in August 2025. The Panel has forty members and writes an annual scientific assessment. The Dialogue met for the first time in Geneva in July 2026 and meets again in New York in 2027. Both are forums. Neither has regulatory authority, and nobody involved pretends otherwise.

The divisions are the ones you would expect. The EU wants risk-based statutory requirements. The US prefers existing law and voluntary frameworks, and resists anything that looks like centralised control. China wants UN-centred global standards. Several members argue that rules written by wealthy countries will entrench the gap for everyone else. Russia questions whether AI belongs in the Council's mandate at all.

So the realistic output of today is a transcript, some headlines, and a slightly better shared vocabulary. That is not nothing. Norms start somewhere, and getting American and Chinese labs to agree in public that loss of control is a category of risk is further than we were a year ago. But it will not tell you what your sales agent is allowed to delete on Thursday.

The gap between the chamber and the desk

There is a symmetry between the Council's problem and yours worth sitting with.

The Council is trying to answer three things: what can these systems do, who is accountable when they do it, and how would we know in time. That is a governance problem, not a technology problem. Nobody in that room is confused about what a language model is.

Now shrink it by six orders of magnitude. You have three agents. One reads your inbox. One has a CRM token. One can push to a repository. The questions are identical. What can they do? Who is accountable when they do it? How would you know in time?

The small version is harder to dodge. The Council can adjourn without a resolution and everyone goes home. Your CRM agent does not adjourn. It runs tonight, with whatever permissions it had this morning, whether or not you ever wrote them down.

Most people have not written them down. Research published yesterday by Guild.ai, surveying 362 IT decision makers at companies with more than a hundred employees, found 96.4% are confident they hold a complete and accurate inventory of their agents, while 66.7% of organisations running agents hit an agent-related operational consequence in the past twelve months. Only 31% can stop a malfunctioning agent automatically. Confidence is not the scarce resource. Knowing is.

What "loss of control" means at your scale

The phrase in France's concept note sounds apocalyptic, and at the frontier it is meant to. At the scale most businesses operate, loss of control is more boring and more likely. It looks like this:

An agent has a credential nobody remembers granting. It was needed once, for a migration, eight months ago. It was never revoked.

An agent retries a failed action silently. The action was an email. The recipient got four of them.

An agent has memory nobody reads. Something wrong went in six weeks ago, and it has been quietly shaping decisions since.

An agent takes an instruction from a source you did not intend to be authoritative. A web page, a document, a forwarded email from outside your company.

None of these threaten international peace and security. All of them are, structurally, the same failure the diplomats are discussing: a capable system took an action, and the humans responsible did not have the visibility to catch it in time.

The four things to actually write down

The Council will take years to produce anything binding. You can do the equivalent work for your own agents this afternoon, and it is not a policy document. It is four lists.

What each agent can reach. Not "it has access to Google Workspace". Which mailbox, which folders, which CRM objects, read or write. Per agent and per skill, not per platform. If you cannot name the scope, it is larger than you think.

What requires a human first. Anything outbound to a customer, anything that moves money, anything destructive, anything that creates a public artifact. The gate belongs on the action, not on the agent. A trusted agent doing an irreversible thing still deserves a pause.

How you would find out. A readable log of what it did and why, in language you can skim, not a JSON dump you will never open. If the only way to discover a mistake is a customer telling you, you have no detection.

How you stop it. Specifically: can you revoke one credential without breaking the other two agents, and does stopping a task also stop the subtasks it spawned? Most people have never tested this. It is a ten-minute test and it is uncomfortable the first time.

That is the whole of it. Four lists, an afternoon, and it puts you ahead of two thirds of companies with more than a hundred employees.

Why we build it this way

A small business does not need the Security Council's framework. But the design instinct is the same, and it is why our AI employees have the shape they do.

Every employee has its own identity and its own credentials rather than borrowing yours, so revoking one does not cascade. Memory is readable, because a colleague whose reasoning you cannot inspect is not a colleague, it is a liability with a name. There is an approval gate for outbound actions, because the difference between a useful agent and an incident is usually one unsupervised email. And an employee that is unsure is supposed to ask you rather than guess, which is the small-scale version of everything Bengio has spent the last three years arguing for.

Self-hosting matters here too, and not for the usual reason. It is not only privacy. It is that the control plane is yours. When the governance question arrives at your door, from a regulator, a customer's procurement team or your own audit, the answer sits in infrastructure you run rather than in a vendor's roadmap.

The diplomats in New York are working on the version of this problem that takes a decade. Yours takes an afternoon, and nobody is going to convene a council for it.

Want to test the most advanced AI employees? Try it here: https://Geta.Team