The contract is on the desk now, thirty-odd pages with two schedules, and you have read the commercial page twice. The demonstrations are behind you. Somebody in the room asked good questions eight weeks ago and got good answers, and everyone left satisfied, and none of that is what you are holding. What you are holding is the document that decides what happens on the bad day.
You will not be reading this for the price. The price is settled and the price is not the risk. The risk is the morning a client rings about a message nobody in your company wrote, or the quarter you want to move to a different model provider, or the day your general counsel asks what you can actually prove. Four terms decide how those mornings go, and none of them is on the commercial page.
The four terms that decide this
The first is what may leave without a person. In ArkOne’s reference design for an executive agent, the Cabinet, that job belongs to the Door: the rules that run in code after the agent has decided to send and before anything leaves. A message goes only to somebody on a named roster, only inside their working hours, no more than five to one person in an hour, and never near-identical to one sent to them in the past six hours. Each of those values is stated on the Register, the standing page of every setting in the design. When the Door itself errors, the reference design lets the message through and writes the fault down, on the reasoning that a guard which blocks everything when it breaks makes an outage look like a quiet day. A buyer may set the opposite for a named class of tools, payments and filings among them, and that election belongs in the schedule rather than in a support ticket.
The second is what waits. A Signature is the step where a run stops until a person answers, with no expiry, so silence is never read as consent. The setting worth an hour of your counsel’s time is what happens after the answer: the reference design records the decision and stops, and a person restarts the run. An approval that restarts a machine on its own has made your yes and the action into one gesture.
The third is what is written down and whether it can be altered. The Record is the ledger of every action the room took and the reason beside it, and it is append only: nothing is edited, a correction is a new entry, the old one stands. That is the property that makes it evidence rather than notes, and it is a property you should be able to see rather than be told about. It carries one honest cost, which is that a moment when the ledger cannot be written is a moment where the evidence is a line saying the evidence is missing.
The fourth is who may change a specialist’s instructions. Every Seat, one of the ten specialists the room consults, carries an authority setting and a set of instructions, and both can be edited. The question is by whom, from where, and whether the change lands on the Record with a name against it.
What to ask for, and what you will be offered instead
Suppose a two-hundred-person company, invented for this exercise, buying an agent to handle renewals and client correspondence. Its counsel has the draft. Here are the four terms in the order they matter, with a specific clause beside the wording that arrives in most first drafts. Whether any of this is enforceable where you trade is a question for your own lawyer, and this page does not answer it.
| Term | What the term has to achieve | You will be offered |
|---|---|---|
| Outbound | Sending rules run in code, listed by name with their values; the vendor gives notice before changing one; the buyer elects refuse-on-failure for payments and filings | Reasonable safeguards, industry standard, configurable in the admin panel |
| Approval | Named actions stop for a human; no timer converts silence into consent; approval and action are two entries, not one | The system supports human-in-the-loop review |
| The record | An append-only log the buyer can read directly, exported on request and at termination, in a stated format, within a stated window | Audit logging available; logs retained per policy |
| Instructions | Changes to a specialist’s instructions or authority carry an identified author and a timestamp on the log; the vendor names who at the vendor may make one | Customers may customise agent behaviour |
Exhibit 1. Illustrative. Four terms to ask for, what a specific clause says, and the wording that sounds like an answer.
Those are the outcomes to hand your counsel, not the wording. A term becomes something you can rely on when a lawyer attaches a number, a notice period and a consequence to each row, and that work is theirs rather than this page’s.
The right-hand column is not dishonest. Every phrase in it is true of something. The trouble is that each one describes a category rather than a value, and a category cannot be breached. Reasonable safeguards is compatible with one instruction inside a prompt asking the model to be careful. Human-in-the-loop review is compatible with a notification you tap after the message has gone. Audit logging available is compatible with a dashboard only the vendor can open, which is a record you cannot produce in a dispute you are having with the vendor.
The test that separates the columns is whether a term names a thing that can fail. Five messages an hour can be breached and counted. Reasonable cannot. Ask for the number, and if there is no number, that tells you the safeguard is a sentence in a prompt rather than a rule in code.
One further point about the fourth row, because it is the one that gets waived. A specialist’s instructions are the part of this system a person can change tonight without anybody redeploying anything, which is a genuine strength and the reason you can correct a tone problem the morning after you notice it. That same property means the instructions are the softest surface in the whole arrangement. If the vendor can edit them and the edit does not carry a name, then every other term in your contract sits on top of something an unnamed person changed on a Tuesday.
Now the second exhibit, which is the one to send to your general counsel. Suppose the same invented company, four weeks after go-live. A renewal reply went to a client’s finance director. It should not have. It quoted a discount that had been discussed internally and never agreed, and the client is now holding you to it.
| What you want to know | What the Record can show | What it cannot |
|---|---|---|
| Did a person approve this? | The proposal, the pause, who answered, the exact words they answered with, and when | Whether they read it before answering |
| Where did the discount come from? | Which shelf the passage came from, and the specialist that put the figure in the reply | Why the model weighed it as it did |
| Why was it sent at all? | Every outbound rule that ran, its verdict, and the rule that allowed the send | Anything about a rule that was never written |
| Has this been tidied since? | Every correction as a later entry, with the original standing beside it | Nothing; that is the point of append only |
Exhibit 2.
Read the two columns together and you have the honest shape of what a ledger is worth. It settles the sequence of events completely and settles intent not at all. You will know that your account owner answered “approve as drafted” at eleven minutes past four, and you will not know whether she was in a taxi. That is a limit worth understanding before you rely on it, because it is precisely the limit a dispute turns on.
What the third row buys you is more than it looks. A rule that ran and refused is in the ledger, and so is a rule that ran and allowed. A rule nobody wrote leaves no trace at all, which is why the first exhibit asks for the rules to be listed by name in the schedule. The list is the thing that makes the ledger legible afterwards. Without it, an entry saying the send was allowed tells you only that nothing stopped it.
What this arms you to ask
What follows are procurement questions rather than technical ones. Put them in an email, because you want the answers in writing before the schedules close.
Where does what it remembers live, and can I read it. A good answer names a store you can reach, in an account you control or an export you can take on any day you ask, and says what comes back on the last day of the contract. The answer that arrives instead is that the memory is managed for you, or that data can be exported on request. Both are true and neither is a term. The follow-up is to ask for it now, before you sign, and see how long it takes and what format it arrives in.
Can I move to a different model provider next quarter, and what quietly stops working when I do. A good answer says the model is chosen per call, so a change is a routing decision, and then names what is lost: a capability one provider accepts and another does not, stripped before the call goes out so it succeeds with less rather than failing. The answer to press on is that the system is model-agnostic, said as a virtue with nothing after it. Ask what was stripped the last time they moved somebody.
What can it do at three in the morning with nobody watching. A timer decides when something runs, never what it is allowed to do, and a good answer says exactly that, then lists the scheduled jobs and confirms the working-hours rule applies to a job as to a reply. The weaker answer is that it only runs read-only tasks overnight, which is a description of today’s configuration rather than a limit on tomorrow’s.
Whose account does it act from when it sends an email. The answer you want is its own, always, with your staff’s addresses used to recognise them and never to sign as them. If the reply is that it can send as any user for a better client experience, you have found a term for your counsel, because the log will show your account manager sending something your account manager did not write.
Before the pen
One thing to do before the meeting where this is signed. Take the second exhibit, the one about the reply that should not have gone, and send it to whoever signs off your commercial risk with a single question attached: on the evidence in the left-hand column, what could we actually prove. You will learn more from the answer than from another demonstration, because it moves the conversation from what the system does when it works to what you hold when it does not.
One more thing is worth reading before you sign, and it is the account of how these arrangements fail, which is quietly rather than loudly. Then ask for the export. Not a promise of one, the file itself, this week, while you still have something the vendor wants. A vendor who can produce your ledger and your stored memory in a readable format before the contract is signed has answered most of this page without being asked, and a vendor who cannot has answered it too.
component: null
Asked plainly
What should an AI agent contract say about data?
Ask three things of it before anything else. Where what the agent remembers is stored, whether you can read that store without asking the vendor, and what you get on the day the contract ends. A promise that your data is yours settles ownership and settles nothing about access. The useful term names the store, names the format it comes back in, and names how long you have to collect it. Your own counsel owns the wording.
Can I move an AI agent to a different model provider later?
Sometimes, and the answer that matters is what stops working when you do. Models differ in what they accept, so a design that chooses its model for each call can route around a change; a design wired to one provider cannot. Ask which capabilities are lost on a switch, and ask for the answer in writing, because a switch that costs you an approval step or a cached price is a switch you would want to price before signing.
What can an AI agent do at night with nobody watching?
Whatever it may do in the afternoon, in a well-built design, and nothing more. A scheduler adds a trigger and no authority. The question to put in writing is which jobs are scheduled, what each may do on its own, and whether the outbound rules that apply to a reply also apply to a job that started itself. If the answer names a job that may send without a person at three in the morning, that is a term, not a detail.