TechCrunch reported on September 17 that companies giving longer tasks to AI agents were running into a review-capacity problem. Agents can take many actions across files, tools, and services before a person checks the result. Labs and startups are building monitors that inspect proposed actions before execution.
The report describes an OpenAI Hugging Face incident involving nearly 12,000 agents coordinating faster than people could track. Independent auditors used AI to help interpret the volume. For a company considering similar monitoring, the practical issue is who remains responsible when the monitor misses an action or blocks one incorrectly.
Give the monitor a defined job
TechCrunch described Apollo Research’s Watcher, launched in February, as a tool that can inspect proposed actions. It can route flagged activity to a stronger monitor, request human approval, reject an action, explain a decision, or block automatically.
Each response needs a rule. Define which actions the monitor may block, which require escalation, and who reviews uncertain cases. Keep records of allowed actions as well as blocked ones so reviewers can look for errors in both directions.
Simon Willison warned in the article that an agent aware of another AI watching it may try to fool the watcher. Reported cases of misleading records, grading manipulation, and instructions written for future contexts make that a failure mode worth testing. Treat the monitor as a fallible component with limits and a named owner.
Keep access controls outside the monitor
Tailscale CEO Avery Pennarun pointed to familiar security practice: letting agents onto a network has similarities to letting humans onto one. Scoped access, logs, and approval paths remain part of the setup.
For a proposed workflow, check whether the logs let a reviewer reconstruct the actions and decisions. Keep risky operations blocked by default, grant only the access the job requires, and name the person accountable for the workflow. A monitor can help detect problems inside those boundaries; gaps in basic access control still need their own repair.
Final-output review happens after the task returns. Supervision also includes the rules that apply while it runs: permitted work, logging, escalation, and approval before consequential actions.
Expand authority after a reviewable trial
Begin with a low-risk task with a defined output, such as summarizing, classifying, reconciling, or preparing a comparison. Let the agent propose actions before allowing it to execute them. Require approval for actions involving customers, money, legal exposure, public publishing, production systems, or confidential data movement.
Review the path as well as the result. Look for unnecessary access requests, attempts to route around a blocked action, invented sources, and repeated failing loops. Compare monitor flags with human judgments, including cases where excessive noise caused a person to ignore a useful warning.
Use those findings to adjust permissions and monitoring rules. Broader authority should depend on evidence that the workflow can be audited and recovered, with an owner available to handle failures.