No One Typed a Prompt: Designing Agents That Decide to Act

For three years, every AI agent you evaluated worked the same way: a human asked, the agent answered. The human owned the trigger. That assumption just broke.

On October 21, Anthropic put Claude Duet into research preview — an application where Claude runs as a background agent, watching your connected apps and requesting approval before important actions. It is not invoked. It is resident. And once one major vendor ships ambient observation as a product category, every SaaS platform you already pay for will have a version of it in their roadmap deck within two quarters.

That changes the question you need to ask in a procurement meeting. The industry has spent a lot of energy on what agents are allowed to do. Almost nobody has written down what they are allowed to notice.

The input surface is the part nobody scoped

Here is the uncomfortable reframe: with an always-on agent, your biggest exposure usually isn't a bad action. Actions are visible. They show up in logs, in tickets, in someone's inbox. Your biggest exposure is an unbounded observation scope — a standing grant of passive read access across email, chat, file storage, CRM, and ticketing that nobody explicitly scoped, nobody formally approved, and nobody can audit after the fact.

Off-the-shelf ambient agents ship with a vendor's default idea of what's interesting. That default is necessarily generic. It has to be — the vendor is selling the same connector to a hospital system and a mortgage brokerage. But only you know that a message in #legal-m-and-a is not the same class of object as a message in #random. Only you know which shared drive holds diligence materials and which holds the holiday party photos. The vendor's agent sees two Slack channels and two folders.

This matters more now than it would have a year ago. The frontier model layer is getting measurably more capable at cybersecurity tasks — recent model releases have been explicitly positioned around security capability, and October alone saw more than twenty model releases across the major labs. A broad, persistent read grant across your connected systems is a more attractive target in that environment than it was when agents only woke up when someone typed into a box.

And the autonomy keeps compounding. Sakana AI recently introduced Multi-Agent Self-Supervision (MASS), a training approach for recursive workflow optimization — supervision itself moving onto the agents. The direction of travel is clear. The governance scaffolding has to move faster than the capability.

Why this lands in a tightening budget cycle

The timing is awkward in a useful way. Hyperscaler capital expenditure recently came in below analyst estimates, with Google and Amazon burning free cash, and the Nasdaq logged its first three-week losing streak. Budget scrutiny is returning to AI spend at precisely the moment agents are becoming more autonomous.

Buyers have already adjusted. A November product-launch roundup notes that the questions have shifted from capability demos to operational specifics: how many customers use your agent weekly, what does it cost per conversation, how do you handle data. Unglamorous agent "plumbing" and voice agents are outselling flashy model launches — Twilio reported 60% year-over-year growth in voice AI revenue in Q4.

Meanwhile the adoption gap is widening, not closing. WRITER's 2026 enterprise survey found 79% of organizations facing AI adoption challenges — a double-digit increase over 2025 — and 54% of C-suite executives saying AI adoption is tearing their company apart. Publicis Sapient's 2026 report, drawing on 1,550 AI decision-makers, found AI now supports 53% of enterprise work while only 18% of organizations have fully integrated it.

Read those two numbers together. Most companies have AI touching most of their work and almost none of it properly embedded. Dropping an always-on, self-triggering agent into that gap without a trigger design is how an AI budget line disappears in 2027.

Four artifacts we build before an ambient agent goes live

When we deploy agentic AI systems that run continuously rather than on request, four documents exist before any production access is granted. None of them are exotic. All of them are missing from most vendor deployments.

1. The event taxonomy

An explicit, enumerated list of the things that may trigger agent action. Not "it watches your systems" — an actual list. A contract uploaded to a named folder. A support ticket aging past a defined threshold. An invoice arriving from a vendor on a specific list. If an event isn't on the list, the agent does nothing with it.

Writing this is harder than it sounds, and that's the point. The exercise forces your operators to articulate which business moments actually warrant machine initiative. Most teams discover the list is far shorter than they assumed.

2. The observation scope contract

Per connected system, in writing: what the agent may read versus what it may merely count. There's a meaningful difference between an agent that knows forty-one new messages arrived in a channel and one that has ingested the contents of all forty-one. Many useful triggers only require the count. Granting full read because it was the default checkbox is how scope gets unbounded.

This contract is also the artifact your security and compliance teams will ask for, and the one that makes a renewal conversation survivable.

3. The interruption budget

A hard cap on how many times per day the agent may escalate to a human. An agent with unlimited initiative becomes an alert-fatigue generator inside of a week — and once your team starts reflexively approving its requests, the human-in-the-loop control you bought has quietly stopped existing.

Capping escalations forces prioritization into the agent's design. If it can only interrupt six times today, it has to be right about which six.

4. The shadow mode period

Thirty days where the agent proposes and acts on nothing. It observes, it evaluates against the event taxonomy, and it writes a reviewable log of what it would have done. You get an evidence base instead of a leap of faith — real precision and recall on your actual data, plus a concrete sense of interruption volume before anyone's attention is on the line.

Shadow mode is also where the event taxonomy gets corrected. It always needs correcting.

The build-versus-configure line just moved

Ambient agents are the clearest case yet where configuring a vendor's product and commissioning a custom one genuinely diverge — because the trigger logic is the business logic. The decision about what constitutes an event worth acting on is not a settings page. It's an encoding of how your organization prioritizes, escalates, and assigns risk. A vendor can't ship that to you, and a configuration screen can't capture it.

(The question of who's accountable once the agent acts is a separate, serious one — worth handling in your contracts and your controls, not assumed away.)

If you're being pitched an always-on agent by a platform you already use, the evaluation is straightforward. Ask for the event list. Ask what it reads versus counts. Ask how many times a day it will interrupt your team, and what happens when that number is wrong. If the vendor can't answer in writing, you're not buying an agent — you're buying a standing read grant with a chatbot attached.

Talk to us before you sign

Levels AI will run a free trigger audit on any ambient agent you're currently being sold: we'll map the proposed observation scope, draft the event taxonomy the vendor didn't, and tell you plainly where the gaps are. No obligation to build anything with us afterward.

If the audit shows the trigger logic needs to be yours, our AI consulting team can scope a custom build from there. Start the conversation with Levels AI.