"Can we trust an agent with write access?"

You decide how much it can do, and you can always see what it did:

• Its permissions are its person's. A key acts only with its owner's permissions; a project the owner cannot see does not exist for the agent.
• Read-only, enforced. A read-only key is enforced by the database itself: it cannot write.
• Nothing silent. Every change is attributed to the key's owner and marked as an agent's.
• Evidence first. The workflow can hold work until the agent provides evidence.
• Acceptance. Quasar's agent contract tells agents to accept documents only on a person's word. To make it impossible, give the agent a key whose owner is not a project lead.
• Time. An agent's time becomes a cost only when a person confirms it.