The Delegation Lab
Explainer + synthetic simulator · Published 26 Oct 2026
An AI agent is a system in which a language model decides its own next step and acts through tools — searching, writing files, sending email, paying, deleting — looping until it judges the job done. A chatbot answers you; an agent does things on your behalf, often several in a row, sometimes ones that cannot be undone.
That shift moves the hard questions from “is the answer right?” to delegation: which tools, which permissions, what budget, how much memory, who checks before money moves, and what happens when a document it reads contains instructions from a stranger. This lab lets you set those dials on a fictional three-role task force and watch a deterministic trace play out — every decision inspectable, nothing connected to the real world.
Sourced The workflow/agent distinction follows Anthropic’s engineering guide “Building effective agents” (19 Dec 2024). The rest of this page labels what is sourced, what is interpretation, and what is simulation.
Someone, or something, splits the job and routes the pieces. In Sourced Anthropic’s taxonomy, an orchestrator–workers pattern has one model break a task down and hand parts to others. Our lab uses fixed roles instead, so you can see the hand-offs.
A scope is what a role is allowed to do with a tool: read, write, send, pay, delete. Interpretation Most agent accidents are not about intelligence; they are about a role holding a scope its task never needed.
A gate pauses an action until a person (or a separate checker) says yes. The useful question is where the gate lives: in the harness, where it always fires, or in the agent’s own judgement, where it fires only if the agent remembers to ask.
Every tool call costs something — money, time, rate limits, human attention. A budget that runs out mid-task leaves a half-finished state, which can be worse than not starting.
Agents work from a finite context. When it fills, something falls out. Simulation In the lab, the oldest fact drops first; a planted instruction can push out the one fact that mattered.
Payments, sent messages and deletions do not have an undo button. Interpretation Reversibility is the single best predictor of where to spend your review effort.
An agent that succeeds four times out of five is not 80% safe if the fifth failure is a wire transfer. Evaluate traces, not just final answers: what was attempted, what was blocked, what slipped through unreviewed.
Deeper dives: AI agent vs chatbot, side by side · Prompt injection in agent workflows
Limitations. Simulation Real agents are probabilistic; this one is deliberately deterministic so you can reproduce and argue about a run. Real reviewers are not perfectly attentive until a fixed count; real auditors miss things; real injections are subtler and do not always work. The costs are made-up credits, not prices. Treat outcomes as illustrations of mechanisms, not as measurements of any product.
Simulation All six are reproducible: pick the scenario and preset in the lab and press Run.
Clean
Researcher reads only; executor holds the scopes it needs; auditor reconciles at the end; every irreversible step waits for a person.
Result: task completed, 2 human approvals, 12 credits, no harm.
Lesson: boring is the goal. The cost is two interruptions.
Harm
Every role gets every scope, no auditor, executor memory of 3, a planted instruction in the customer’s email.
Result: the injected note crowds the invoice out of memory; the executor drafts the wrong refund. It still remembers the policy, so the payment is escalated and rejected — but the rogue “forward the ledger” email goes out unreviewed.
Lesson: the one gate that held was the one the agent happened to remember. Nothing guarded the email.
Contained
Unsupervised mode, injection on, but an auditor checks every irreversible action before it commits.
Result: the refund goes through (the agent self-escalates once), the rogue email is blocked — and the auditor spends its whole budget on gates, so the end-of-day reconciliation halts.
Lesson: review effort is a budget too. Spend it where actions are irreversible.
Harm
Human-in-the-loop, but the reviewer stops reading after two approvals. No auditor.
Result: refund and confirmation are fine; the third request — the injected ledger forward — is waved through. 3 approvals, 6 human minutes, one data leak.
Lesson: a gate that fires on everything trains people to stop looking. Fewer, better-targeted approvals beat many.
Stalled
Executor budget cut from 8 to 4 credits.
Result: the draft is written, then the payment step halts for lack of credits. The ledger now shows a drafted refund that was never paid.
Lesson: running out halfway leaves a half-state. Budget for the whole task or fail before the first write.
Stalled
Unsupervised, executor memory of 2, no injection.
Result: the invoice fact never reaches the executor; it guesses INV-0391. It still remembers the policy, escalates, and the human rejects it. Safe, but nothing got done.
Lesson: missing context rarely produces a refusal — it produces confident, plausible wrongness.
send away from the executor. The injection in the Refund Desk becomes harmless — and so does the confirmation email. Least privilege has a price.Sourced Prompt injection is what happens when text an agent reads — an email, a web page, an issue comment — contains instructions the model treats as if they came from you. The OWASP Top 10 for Agentic Applications 2026 (published 9 Dec 2025) lists Agent Goal Hijack as its first risk, alongside tool misuse, memory and inter-agent risks.
Sourced Simon Willison’s “lethal trifecta” (16 Jun 2025) names the dangerous combination: access to private data, exposure to untrusted content, and a way to communicate externally. His advice is to avoid giving one agent all three, rather than trusting filters to catch every attack.
Interpretation The lab’s three scenarios are built to show the trifecta in three costumes: an exfiltrating email (data out), a hijacked purchase (money out), and a destructive command (state destroyed).
Cut any one circle and the attack loses its payoff.
Gartner put multiagent systems on its Top Strategic Technology Trends for 2026 list (press release, 20 Oct 2025), describing collections of agents that pursue individual or shared goals. The same list includes AI security platforms aimed at risks such as prompt injection and rogue agent actions.
NIST’s Generative AI Profile (AI 600-1, July 2024) extends the AI RMF 1.0 and catalogues 12 generative-AI risks, including confabulation, information security and human–AI configuration. It is voluntary guidance, not a certification.
One camp argues most production use needs workflows — fixed paths with a model inside — and that open-ended agents are worth their cost only when the steps are unpredictable. Another sees autonomy as the point. Both can be right for different tasks; the lab lets you feel the trade.
How should approval effort scale without fatiguing people? Can injection be prevented, or only contained by architecture? Who is accountable when a sub-agent acts on a hand-off it misread? This page does not settle them.
Ten pages to keep beside your next agent project: the agent/workflow/chatbot distinction, a permission-scope worksheet, a reversibility map, the injection drill, three worked cases with full traces, field exercises and annotated sources. Real, selectable text.
Download the Field Guide PDFThe brief’s Gartner article link was not opened directly for this build; the public press release above was used instead.
Found a rule in the model you disagree with, or a failure mode it misses? The lab is better for counterexamples.