When the Assistant Acts as You

For the past few months I have let an AI assistant handle routine work in my browser. I decided what to do and approved each step. The assistant did the clicking: opening sites, filling in forms, attaching files. It worked through my browser, where I was already signed in.

To every site it touched, all of it was me.

So I asked myself the questions I would ask about any agent in an environment I was responsible for. At first I could not imagine how I would answer them. Once I tried, the answers were easy. They just were not reassuring.

Whose authority does it use? Mine. It borrowed my signed-in session.

What may it do, and what may it not? Anything I can do on those sites. The only limit was my rule that it ask before each step. That rule lived in our conversation. Nothing on those sites enforced it.

How are its actions logged? The chat is the only record of what the assistant did. Every site's record shows me.

How does it get turned off? I end the session or disconnect it. That part is easy.

Who answers for it? I do, for everything it did, whether I typed it or not.

My book opens with an access form that could only grant. This has the same shape: the assistant got everything I have, and nobody decided that on purpose.

This is one person and low stakes. Now picture it across a workforce: people connecting assistants to their email, their files, and the systems they administer, each one acting under that person's name. Every log says the person did it. When something goes wrong, nobody can say whether the person acted or the assistant acted as them, and the person is left answering for both.

In my book I call an assistant driving someone's own signed-in session a shared account without a vault. It uses access the person already has, and the record was never built to tell them apart.

For a leader, the work starts before anyone connects anything.

Decide on purpose which assistants may connect, and how. Make the approved path easy, or people will decide for themselves.

Where you can, choose connections that put two names on every action: the person, and the assistant acting for them.

Add one question to the access reviews you already run: what is connected to this person's account, and does it still need to be?

And before an assistant acts as someone, ask that person the questions above. If their answers sound like mine, it should not act as them until the record can show both names.

I still use the assistant. I just know now which of my answers depend on me.

Related

• Series 2 Post 13: LinkedIn post
• Series 3 Post 2: LinkedIn post