Duet asks you before it acts. Inside a company, it should ask whoever owns the thing it is changing.

All four big personal agents have a version of the same safety rule.

Claude Duet shows you the action it intends and waits for approval before it sends a message, makes a payment, signs a document or deletes anything. Muse asks before sensitive actions like sending an email or buying something, and Meta adds a second agent, Sentinel, that checks outbound actions and that Muse cannot override. OpenAI's dots run consequential actions through an automatic review, and when a dot is working on its own initiative, its app connections are read-only.

These are good rules. They are also all built around one relationship: the agent and its person.

The colleague nobody asked

Inside a company, most things an agent might touch belong to someone else.

Say Maria's personal agent reads the notes from Thursday's meeting and sees that a commitment owned by James, "send the revised proposal to the client," looks finished because the proposal is in a shared folder. It proposes to mark the commitment done. Maria's agent asks Maria. Maria taps yes.

James never saw it. Maybe the proposal in the folder was a draft. Maybe the client asked for one more change on a call. The commitment was his, and it closed without him.

Nothing malicious happened. The agent asked permission, from the wrong person.

Now multiply that across a team where everyone has an agent. Agents will update numbers on someone else's scorecard, close problems someone else raised and reshuffle priorities someone else owns, each change approved by its own person and none by the owner.

Ownership already tells you who to ask

Companies that run well already know who owns what. Each priority has one owner. Each number has one owner. Each commitment has one owner and a due date.

So the rule for personal agents inside shared company systems is short:

An agent may read anything its person may read.
An agent may change what its person owns, with its person's approval, the way Duet already works.
An agent that wants to change something someone else owns asks that person, not its own.

Rule three is the new one. It turns "my agent did it" from a surprise into a request. James gets a note: "Maria's agent thinks your commitment is done. Confirm?" One tap, and the record is right.

Why the vendors cannot build this for you

Anthropic, Meta, OpenAI and Google can build approval into their agents, and they have. What they cannot know is who owns what inside your company. Duet does not know James owns that commitment. It knows Maria connected an app.

Ownership lives in your system of record, if you have one. That system is the only place the rule can be enforced, because it is the only place that knows whose thing it is.

Read first, then act on your own, then ask

We have argued before that agents should read first and act later. Personal agents add a middle step.

Stage	What the personal agent may do
Read	See the plan, numbers, commitments and decisions its person can see
Act on your own	Update what its person owns, with its person's approval
Ask the owner	Propose changes to anything else, and let the owner decide

Most companies should start every personal agent at the first stage and move it up on purpose.

Sources

Give your team's agents the plan

Personal agents read whatever they are connected to. OTP is where your company's chart, priorities, scorecard and commitments live, and any MCP client can connect to it. In Claude or ChatGPT, add a custom connector with this address:

https://orgtp.com/api/mcp

Then ask: "Using OTP, what are my priorities this quarter, what did I commit to in our last meeting, and what is due this week?"

Start free at orgtp.com. Every seat is free, for people and agents. You pay only for the AI you use.

The series

All ten on one page: Personal agents are coming to work

Series: Personal agents are coming to work. Part 5 of 10. Read this post as Markdown: /blog/personal-agent-approval-belongs-to-the-owner.md.