An unguarded agent got a founder banned from Resy in 48 hours. Recovery took 32 days.

The portable part of this is the identity. He gave the agent his own Resy login ^[5], so nothing on the platform's side separated a piece of software from the customer whose name was on the account, and the penalty landed where the credential pointed ^[6]. Any agent handed live access to a vendor account inherits that property by default.

Getting back in is where the numbers are worth writing down. Distelburger says he had heard secondhand that Resy restores accounts after a month, so he waited the month out, and the month passed with nothing ^[11]. The letter that finally worked came from Hannah, the coordinating agent in a stack he runs on a Mac Mini with subagents for sports and for restaurants ^{[12][2][3][4]}. It drew a reply in two days ^[14]. That is roughly 32 days of outage against 48 hours of detection, about sixteen times longer to reverse than to cause ^[16][17]. The only messages that produced a substantive answer were the ones he did not write himself ^[19].

Look at what the successful letter had to reach for: Resy's policies, the length of his customer history, and his standing as an American Express Business Platinum customer ^[13]. None of that is available to an analyst who wired an agent into a shared vendor account last quarter. The appeal path for agent misbehaviour is currently the same path used for any commercial dispute, and it pays out on tenure and spend.

The interim was procurement. With no Resy account, he bought the highest tier of Dorsia, a competing reservation service that requires a minimum commitment, costs real money, and carries thinner inventory ^[8]; before that, he and his wife booked on her account ^[9]. Those are the workarounds nobody puts in a plan and everybody reaches for in the actual month.

What the episode lacks is a rule. Distelburger's own read is that most sites and companies have not worked out how they want agents to engage with their services ^[15]. The boundary is real, it is enforced by pattern detection, and it is lifted at someone's discretion. A single reinstatement, won by a well-argued letter from a long-paying customer, is not something a workflow can be designed around.

So the scoping question for putting agents into a workflow is not capability. It is which accounts can be gone for a month, and whether anyone at the vendor will pick up while they are.