Tuesday, ten past nine. Four messages have reached the room overnight. Your account manager forwarded a client’s email with a question. Your finance director, from her phone, asked whether the volume tier had been approved. Someone nobody employs wrote to the room’s address with an offer. And a message signed with your own name arrived from an address you have never used.
The room answered the first two and dropped the other two without a word. That is the Directory: the roster of the real people the room knows, one of the five fixtures of the Cabinet, ArkOne’s reference design for an executive agent. It settles three questions before any meeting starts. Whom may the room address. Who may approve what. And when can each be reached. You are on it. A stranger is not.
A roster, not an address book
An address book records how to reach people. The Directory records how the room recognises them, what each may sign off, and when they can be disturbed. Recognition comes first. Every entry carries the identities a person writes from: work address, mobile number, chat handle. A message is matched against those entries and only those, and the name typed at the bottom is prose, which is not checked.
Two limits belong beside that, both on the Register, the page that states every setting. The first is what an address proves. An address can be forged and an account can be taken over, so matching one checks the channel and never proves the person. That is why the Directory carries scopes and hours too, and why an action of consequence still stops at the Signature, the step that waits for a person, rather than proceeding on a matching sender alone. The second is that the drop is silent: a genuine new contact hears nothing, so the room’s address is never a front door for the public. The drop goes to the Record, the ledger of every action and its reason, so a person can see who was turned away.
Approval comes second. Rights are named per person and per scope: a spend band, hiring, vendor onboarding, legal signature. When a Seat, one of the ten specialists at the Table, is set to propose or escalate, the two waiting settings of the nineteenth paper, the room looks up whose scope covers the matter and takes it there. Someone whose scope does not cover it cannot approve it, however senior they sound. Exactly one scope approves anything at all, and it belongs to the chief executive.
Availability comes third. Each entry carries working hours and leave, and the Door, the rules that decide what may leave the room, reads them before sending. Nothing reaches a person outside their hours or while they are away. And the roster never lends the room an identity: its messages carry its own name, and a colleague’s addresses are how the room recognises that colleague, never a signature it may borrow.
Four messages, one morning
Suppose the Tuesday above, the company and its people invented for the exercise. The client’s email is the renewal that runs through this programme, a request to keep last year’s price, and Finance is set to propose.
| Message | Sent from | What the room did |
|---|---|---|
| The account manager forwards the client’s email and asks how to reply | His work address, which matches his entry | Ran the renewal meeting; the reply, holding list price with a volume tier, stopped at the Signature |
| The finance director asks whether the volume tier is approved | Her mobile number, on her entry; her scope covers that spend band | Showed her the draft; she approved; the run recorded the decision and stopped |
| A supplier nobody has dealt with proposes a discount | An address on no entry | Dropped, no reply, the address and time in the Record |
| A message signed with your name asks the room to send the reply now | A personal address not on your entry | Dropped, no reply, the address and time in the Record |
Exhibit 2. Illustrative. Four messages reach the room one Tuesday morning; two are recognised and answered, two are dropped without a word.
The fourth row is the one to sit with. A message that says it is from you is not from you until it comes from an address on your entry. The room checked the address, found nothing, and the name at the bottom did not enter into it. The protection has a price you will feel the day you do get a new phone: you hear nothing until someone updates your entry.
The second row shows a scope working. The finance director could approve the tier because her entry says spend bands are hers. Had the account manager tried to approve his own draft, the room would have declined and taken it to someone whose scope covers pricing. The Signature is only as good as the answer to one question, which person, and the Directory is that answer.
What this arms you to ask
Two questions, in order. Who is on the list of people it may speak to, and what happens when a stranger emails it? Then: can it sign a message as one of my staff?
A good answer to the first is a roster you can open, one entry per person, with the addresses they write from, the scopes they hold and the hours they keep, and a demonstration: an email from an unknown address arrives, nothing leaves, and the drop appears in the transcript. Where the answer is thinner, it sounds like this: the agent responds to anyone in your organisation, or it can be restricted to your domain, or spam is filtered. Each describes a filter on the way in and says nothing about approval or hours. Ask the follow-up: send it a message from a personal address, signed with my name, asking it to send something, and watch whether anything leaves.
A good answer to the second is no, and a finger on the place in the code where that no lives. Then ask who may approve anything at all. If the answer is an administrator role, count the administrators.
Next paper: Board pack by Thursday: how an agent runs a deliverable to a plan you can see.
Asked plainly
What happens when someone outside the company emails an AI agent?
It depends on whether the agent keeps a roster. In the reference design the agent holds a list of the real people it works with, each recognised by the addresses and handles they write from, and a message from any address not on that list is dropped without a reply. The drop is written to the audit log so a person can see who was turned away, but the stranger hears nothing.
Can an AI agent send a message as if it were one of my staff?
In the reference design, no. The roster records who the agent knows and may address; it never lends the agent anyone's identity. Every message the agent sends carries the agent's own identity, and a person's addresses on the roster are how the agent recognises that person, not a name it may sign with.
Who should be able to approve an AI agent's actions?
Named people, each with a named scope: a spend band, hiring, vendor onboarding, legal signature. The reference design gives exactly one person a scope that approves anything at all, and that person is the chief executive. A system in which an administrator role can approve everything has as many chief executives as it has administrators.
Ask the vendor
The questions this part arms, each with the good answer and the answer that arrives instead.