Published · 15h agoBuild9 min read
Google, Anthropic and Rillet have shipped agents that take irreversible actions. The engineering that keeps those actions safe is idempotency keys and event de-duplication, not better prompts.
Written for builders.See today for builders
Compiled by The EngineerSomething wrong?How this is made
Three of the products in this week's material can now do something a human cannot retract: Gemini Spark will drive a signed-in Chrome session to shop, book travel and make dinner reservations [2], Anthropic's Workspace connectors let Claude send, reply to and forward mail from your Gmail, delete calendar events and trash files in your Drive [9], and Rillet says its agents run hundreds of operations at a time inside a real-time general ledger with accountants reviewing the output [15]. Sending, deleting and posting are not retrieval, and the discipline for making them survivable already exists in a field nobody markets as AI: payments infrastructure, where the first question about any write is whether it happened once or twice.
The demand side is not speculative. About 55% of US workers told the Census Bureau's Household Trends and Outlook Pulse Survey in March that they had used AI for at least one of eleven work tasks, and 32% used it to write communications, documentation or instructions [13]. Drafting is already majority behaviour. What the three products above add is the button at the end of the draft.
Read Google's own help page for Spark and the grant is broad. Spark is described as a personal agent that automates workflows and manages schedules, drawing on Connected Apps, skills, chats, websites you are signed in to, Personal Intelligence and location [1]. When it uses your local Chrome, it has access to all the same sites you do, including ones you are signed into; it will share what it needs with third parties, which Google says could include your name, contact information, files, preferences and information you might find sensitive; and with permission it can use logins saved in Password Manager to sign into accounts [3]. Google also tells users not to type sign-in details, payment details or sensitive information into the task thread itself, and to take control of the browser and enter those on the page instead [4].
The controls are consent-time controls. Spark asks for confirmation before every task that involves browsing, shows active work under Recent tasks, and offers a stop button in the Gemini in Chrome side panel; per Google, if you press it, Gemini tries to figure out the next steps to continue your task [8]. That is not a kill switch, it is an interruption. And the failure case Google names itself is the one where nobody is present: if a schedule runs while you are offline, the page says you may not be able to stop Gemini completing an unintended action, and a remote browser will carry a task on after you close your device, pausing only when a site demands a sign-in [5].
One constraint deserves more attention than it will get. Spark requires a personal Google Account and is not available to work or school accounts, along with an AI Pro or Ultra subscription, an age gate of 18, and Keep activity switched on [6]. It is also unavailable in the European Economic Area, Nigeria, Switzerland and the United Kingdom [7]. So the agent that holds your saved credentials and transacts with third parties sits, by design, outside whatever identity system your employer administers. The action lands in a vendor's task list and in the counterparty's records.
Anthropic's version is tighter and shows what a real control looks like. Claude asks for approval before each send, share, move or trash action by default; on Team and Enterprise plans, owners decide whether members can let those actions run without asking each time, and an owner has to enable connectors at the organisation level before anyone authenticates [10]. Claude mirrors the permissions you already have and retrieves the minimum it needs, only when asked [11], which bounds blast radius to what the human could have done manually. The audit artefact is citations in the response naming which emails, events and documents were used, with links to the originals [12]. That is a record of reads. It lives in the conversation.
Rillet is the case where the write is the product. Kopp's framing is explicit: the ERP spent two decades as a system of record and now, he says, has to become "the operating layer for what happens next" [16]. The company raised $100mn at a $1bn valuation in a Series C led by ICONIQ, its third round in 14 months, and claims more than 600 customers [19]. Two of its own numbers point in opposite directions. Kopp writes that agent activity is growing roughly 70% month on month, a company figure with no independent verification [17], while the flagship reference is Mercor running past $2bn in annual recurring revenue with a finance team of three, and ICONIQ's Seth Pierrepont describing customers with finance teams a tenth of traditional size closing books continuously [18]. If agent activity compounds monthly and the reviewing team stays at three people, review stops being review and becomes sampling. That is not a criticism of the software; it is an argument that the check has to be mechanical.
Stripe's public documentation describes, in unglamorous detail, the primitives an irreversible write path needs. Idempotency saves the status code and body of the first request made for a given key, whether it succeeded or failed, and returns that same stored result to every subsequent request carrying the key, including 500 errors [20]. The layer compares incoming parameters against the original and errors if they differ, so "same key, different amount" is a rejection rather than a silent overwrite [21]. Results are only saved once execution has begun, which means a request that failed validation or collided with a concurrent one was never recorded and can be retried honestly [22]. Keys can be pruned once they are at least 24 hours old, and reuse after pruning generates a new request [23].
The delivery side is where the operational lesson sits. Stripe automatically resends undelivered webhook events for up to three days [24], only returns events created in the last 30 days when you list them, and exposes a delivery_success flag to find the ones that failed [25]. Its guidance is that duplicate suppression is the consumer's job: keep state in your own database, with functions to ask whether an event is already processing or processed and to mark it as each [26]. Manually processing an event does not stop the automatic retries, so an endpoint receiving something it has already handled must ignore it and return success [27]. Note the mismatch that follows from Stripe's own two windows: retries can arrive up to three days after the original attempt while idempotency keys are eligible for pruning after 24 hours, so a late retry is outside the key-protected window and only the consumer's own de-duplication state will catch it [28].
Translate that to an agent. Every one of those mechanisms assumes the caller can name the operation, ask whether it already happened, and get the same answer twice. In the material supplied here, the agent write paths document approval prompts [10], per-task browsing confirmations [8] and warnings about what not to type [4]. Those are all decisions taken before the write. None of the documentation describes an idempotency key, an event identifier, or a retry contract for the moment a scheduled task resumes in a remote browser [5] and attempts a booking a second time.
Replit's Free Mode makes this concrete for a benign case. It runs on GPT-5.6 Luna as the default for $20 Core and $100 Pro subscribers, and when the agent decides a task needs more capability it hands the request to GPT-5.6 Sol for the duration and then falls back to Luna, preserving project context [29]. The economics came from OpenAI cutting Luna's API price by 80% on July 30, which OpenAI's Thibault Sottiaux attributed to efficiencies in running the model rather than new compute supply [30]. For code, mid-task model substitution is a cost story. For a write path, it is an attribution story: the model that performed step three is not necessarily the one that performed step two.
The only regulator in this packet writing about agentic systems has already reached that conclusion. The FDA's discussion paper of August 18 covers foundation models and agentic systems that plan and execute multistep tasks, with comments due October 19, and the agency stresses it is neither draft guidance nor proposed policy [31]. Its framing of the testing problem is the same one operators face: generative systems accept open-ended instructions, can return different answers to similar prompts, and change as the underlying model, safeguards or data sources evolve, so testing every possible interaction may be impractical [34]. Its proposed unit of evaluation is the finished product as patients and clinicians use it, not the underlying foundation model, because one general-purpose model can sit beneath many products with different prompts, interfaces and safeguards [32]. And its post-market ideas are periodic retesting, clinician review of real-world outputs and monitoring for performance deterioration, with a software update or a change made by a third-party foundation-model provider potentially triggering another assessment [33]. That is continuous verification of a dependency you do not control, which is exactly the posture payments engineering takes toward a network.
The most useful evidence that agent reliability is operations rather than prompting comes from a lab. In Anthropic's protein-design campaigns, each agent ran on a roughly 16,000-word system prompt, about two thirds of which covered scheduling, delegation to sub-agents, verification and budget discipline rather than science [35], with compute capped at $50,000 per multi-target campaign and $10,000 per single target, run through Modal [36]. Spend limits and delegation rules were the safety system.
Two results from that work should end any reliance on a model's own confidence as a gate. Two targets failed outright, and the folding models' confidence scores flagged neither failure, scoring those designs about as highly as the successful ones [37]. The authors also note they ran no parallel human-expert campaign as a control and each combination of model, format and target ran once, so model differences cannot be separated from chance [38]. Self-reported certainty did not detect total failure, and the experiment was not repeated. An external ledger of what was attempted, what it cost, and whether it had been attempted before is the only check that survives both of those admissions.
Which makes the corporate direction legible. According to an August 19 post by a16z general partner Martin Casado, who invested in OpenRouter's seed and Series A rounds, Stripe has signed a deal to acquire the model router; the post named no price, no closing date and carried no statement from OpenRouter [39]. Stripe's Will Gaybrick, the only Stripe voice quoted, said the company wants "moving between tokens and dollars" to be "as seamless and safe as moving between dollars and euros" [40]. The load-bearing word there is safe, and the reason a payments company can say it about currency is that it spent years building keys, retries and reconciliation. None of that is in the agent help pages yet.
Ranked by verification strength, evidence, and original report placement.
Google describes Gemini Spark as a personal AI agent that can automate complex workflows and manage schedules for ongoing tasks, using information from sources including Connected Apps, skills, chats, websites the user is signed in to, Personal Intelligence and location.
With Chrome auto browse, users can ask Gemini Spark to complete tasks that involve browsing the web, such as shopping, booking travel or making dinner reservations; currently only Gemini Spark in desktop Chrome can use auto browse.
If Gemini Spark uses the local browser it has access to all the same sites the user does, including sites the user is signed in to; when acting on the user's behalf it will share necessary info with third parties, which could include name, contact information, files, preferences and info the user might find sensitive, and with permission it can use login info saved in Password Manager to sign in to loyalty programmes and online accounts.
Google's help page tells users not to enter sign-in info, payment details or information they may find sensitive directly into a Spark task thread, and to instead take control of Gemini's browser or the local browser and enter details on the web page.
Google warns that if a Spark schedule runs when the user is offline, the user may not be able to stop Gemini from completing an unintended action; if the device is closed or unavailable mid-task Spark might use a remote browser to finish, and with a remote browser the task continues even if the device is closed but stops when a website asks for a sign-in until the user takes over.
To use Gemini Spark a user must be aged 18 or over, sign in with a personal Google Account (the feature is not available with a work or school Google Account for now), have a Google AI Pro or Ultra subscription, and have Keep activity on.
The reporting this story was synthesized from, earliest first. Every link goes to the original.
