Where do bad agents go?

An agent with real credentials takes real actions. It books, buys, emails, deploys, and commits on someone's behalf. When ordinary software misbehaves, we know what to do: roll it back, patch it, take it offline. An autonomous agent that acts for you needs somewhere to go when it gets it wrong — and right now, there is no "somewhere".

What's missing isn't smarter models. It's the accountability plumbing underneath them: a clear scope of what an agent may do, a record of what it actually did, a fast way to revoke its authority, and a path to correct the damage.

I keep calling the end state "correctional facilities for bad agents". Less metaphor, more checklist: sandboxed runtimes, permission budgets, complete action logs, credential revocation, incident review, and re-certification before an agent is released back into productive work. Not punishment — correction.

If I were building toward it, the first pieces are unglamorous: an audit trail every agent action is accountable to, budgets that cap what an agent can spend or touch, a kill switch that actually works, and a post-incident review that reads like a product surface rather than a postmortem nobody reads.

That's the problem I'm pointing my next decade at — at work, and in public. If you're building in the same space, or you need someone who takes agentic systems seriously in production, I'd like to hear from you.