A supervisor message is not a permit.

Video caption

A supervisor message is not a permit. Retrieval can miss the fact; a saved summary can outlive it. Verify permission at dispatch, even when the message is accurate. Narration uses Eric's authorized AI voice clone. #EricFieldNotes

Full written post / accessibility read

A specialist agent needs a tenant exception exactly when it plans a consequential change. A policy-steward agent can send a short message with the exception, source, version and expiry. That helps the worker reason. It does not authorize the service to change production.

If the worker never queries the right document, retrieval alone may miss the exception. If the supervisor pushes an old summary, the worker may act on stale policy. Flooding every agent with the entire archive simply moves the problem into attention and context limits.

Let the steward notice the pending tenant operation and send one narrow evidence packet. Have the worker cite it in the action request. The target service still checks current eligibility under the caller's scoped identity. Remove the message and send a stale one in separate tests.

Use role agents to route relevant knowledge and a service permit to authorize the effect. Log which source the worker used and reject stale claims at the target. Do that because an intelligent supervisor can improve attention without becoming an unreviewed credential issuer.

Narration uses Eric's authorized AI voice clone.

#EricFieldNotes

Four-beat scene transcript

1. A supervisor message is not a permit.

A specialist agent needs a tenant exception exactly when it plans a consequential change. A policy-steward agent can send a short message with the exception, source, version and expiry. That helps the worker reason. It does not authorize the service to change production.

Visual: Useful context can arrive without conferring authority.

2. Two failure modes coexist.

If the worker never queries the right document, retrieval alone may miss the exception. If the supervisor pushes an old summary, the worker may act on stale policy. Flooding every agent with the entire archive simply moves the problem into attention and context limits.

Visual: Retrieval can miss the fact; a saved summary can outlive it.

3. Inject a bounded claim.

Let the steward notice the pending tenant operation and send one narrow evidence packet. Have the worker cite it in the action request. The target service still checks current eligibility under the caller's scoped identity. Remove the message and send a stale one in separate tests.

Visual: Carry source, version, expiry and contradiction status.

4. Separate context from capability.

Use role agents to route relevant knowledge and a service permit to authorize the effect. Log which source the worker used and reject stale claims at the target. Do that because an intelligent supervisor can improve attention without becoming an unreviewed credential issuer.

Visual: Verify permission at dispatch, even when the message is accurate.

Research and claim limits

• OpenAI Agents SDK handoffs (S207)
• IETF RFC 8693: OAuth 2.0 Token Exchange (S208)
• OWASP Authorization Cheat Sheet (S229)

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.