From Text to Action

A model that only writes is safely sealed off. Whatever it says stays on the screen, and the worst it can do is be wrong at you.

Letting it do things sounds like it should require some fundamental new capability. It does not, and the actual arrangement is more mundane than most people picture. The model still only writes. What changes is that somebody now reads what it writes, and if it writes something in the right shape, they go and do it, then write back what happened.

That is the whole trick. The model never touches anything. It asks, in text, and a perfectly ordinary program decides whether to comply. Everything that gets called an agent is some version of this, run in a loop until the job is finished or something stops it.

Knowing that the model only proposes is not a technicality. It tells you exactly where the safeguards can live, which is not inside the model at all, and it explains why the interesting failures are rarely the model saying something wrong. They are about what it was permitted to ask for, and who was checking.