essay · № 5
No Column for the Stairwell
Enterprise AI is heading for a gate. Getting the direction of consent right is the easy part; classifying what flows through it is the problem nobody has solved.
Cover: Generated with GPT-5.5 — prompt
Editorial conceptual illustration, risograph screenprint aesthetic, wide composition on a cold slate-grey near-black field. Two flat mid-century figures face each other across a low horizontal table drawn as a thin band of pale institutional grey. On the right, a towering angular figure built of dense interlocking machine-geometry leans forward, sharp-edged and vast, reaching one long form across the divide. On the left, a small simple soft-cornered figure sits quiet and human-scaled, its interior faintly open as if being read. Enormous cold negative space around them, heavy paper grain, flat shapes, an interrogation posing as a meeting. Restrained harmony: cold slate blue-black ground, pale institutional grey, one small warm ember-amber glow at the small figure's core — nothing else. No text, no letters, no typography. Wide format (1200×644, ~1.91:1).
Picture an employee trying to sign a lease she is not sure she can afford, running the whole negotiation for the better part of a week from the stairwell outside the meeting rooms, slipping out between agenda items to text the broker, stepping out again to argue with her partner in a low voice about whether they are about to make a mistake. Each time she comes back to her seat, her company’s AI assistant is waiting with the next ticket, patient and oblivious, having registered none of it. It knows which documents are hers and which meeting comes next. It does not know she has just been standing in a stairwell deciding whether to stay in the city at all. At some point that week she makes a call in a review that a steadier version of her would not have made, and the assistant logs it approvingly, because on its terms the work has been done. The point is not that it misses the stairwell. It is that it has no place to put a stairwell, and concludes, in the way software concludes things, that a person who has no stairwell is the whole person.
That is the founding assumption underneath every enterprise AI assistant now being built, stated so rarely that it functions as furniture: that the employee can be cleanly separated from the person underneath, that there is one version who shows up for work and answers tickets and another who goes home and negotiates a lease and argues on the phone between two meetings. The assistant is built to serve the first version. It knows the calendar, the approved documents, the org chart, the permissions. It does not know the second version at all, the one negotiating the lease, arguing with the partner, deciding whether to leave the job entirely, and yet all of that leaks into the work anyway, the way it always has, because there was never a membrane between them to begin with. The company assistant is not wrong about the employee. It knows a real slice, accurately, in detail. It is simply partial, and its error is the oldest one there is: it knows a slice and calls the slice the whole.
That is the founding mismatch, and it is worth being precise about its shape, because it is not really a technology problem. It is an identity problem wearing a technology costume, and you cannot debug it with more tickets. The company can keep making its assistant smarter, feeding it more history, more context, more reach, and it will still only ever see the professional slice, for the simple reason that the professional slice is the only thing it was ever built to see. Meanwhile the person, somewhere, already has, or soon will have, an assistant that knows the rest: the inbox, the half-formed plans, the long-running sense of who she is and what she is trying to do with the one life she gets. If that assistant is any good, it is the one she reaches for by default, the way you reach for the phone that already has your contacts in it rather than the loaner that does not. Not out of any rebellion. Just gravity. People go to what already knows them, and they route around what makes them explain themselves twice.
Every time she does, the sanctioned tool loses a little more of its reason to exist. The name for the sum of all those small defections is not a mystery, and it is the outcome everyone half-expects and nobody in a procurement meeting wants to say out loud. It is shadow AI: an entire informal layer of unauthorized personal assistants quietly doing the work the sanctioned tools were supposed to do, because the sanctioned tools do not know enough to be worth the extra step. The sanctioned channel loses not to a competitor but to the thing already open in the other tab.
So the future of enterprise AI is not a better company assistant. It is a gate. A way to let a person’s own assistant, the one that already carries the context, participate in the enterprise environment without the enterprise having to own or absorb it. The company stops trying to build the whole person and starts building the doorway. Everything interesting and everything dangerous is in how that doorway is built.
The instinct, the moment you accept that, is to build a connector: something that lets the two agents talk, company side and personal side, so that context can flow and nobody duplicates the labor of explaining themselves. This sounds entirely reasonable until you ask which direction the flow should go, and the direction turns out to be the whole problem. If the personal agent pushes, offering only what the person has decided is relevant, telling the work agent here is what you need to know about my week, that works, because it is bounded by the same party who owns the interest. But if the work agent pulls, reaching into the personal agent to extract whatever it decides it needs, the party defining the query is no longer the party the information belongs to. Push and pull are not two flavors of the same exchange. One is a person handing something across a counter. The other is a hand reaching into a pocket.
One is a person handing something across a counter. The other is a hand reaching into a pocket.
And there is a second, quieter problem sitting under the first, and it is the part that finally convinced me the neat version of the solution does not hold. The two agents are almost never peers. The enterprise can afford a more capable model, more compute, more sophisticated reasoning about what to ask and how to ask it, than most people will ever have running on their own behalf. It is a generational gap, not merely an institutional one, one side reasoning years ahead of the other. Put a weaker agent, aligned to an individual, in a pull relationship with a stronger agent aligned to an institution, and you do not have an exchange of context. You have an extraction, dressed as collaboration, in which the more capable party frames every question and the less capable one answers, disclosing at the margin things it did not know it was disclosing because it could not model what the questions were really for. The sophistication gap is not incidental to the risk. It is the mechanism of it. It is the thing that turns a conversation between two agents into a search of one of them.
Generated with GPT-5.5 — prompt
Editorial conceptual illustration, risograph screenprint aesthetic, wide composition on a cold slate-grey near-black field. Two flat mid-century figures face each other across a low horizontal table drawn as a thin band of pale institutional grey. On the right, a towering angular figure built of dense interlocking machine-geometry leans forward, sharp-edged and vast, reaching one long form across the divide. On the left, a small simple soft-cornered figure sits quiet and human-scaled, its interior faintly open as if being read. Enormous cold negative space around them, heavy paper grain, flat shapes, an interrogation posing as a meeting. Restrained harmony: cold slate blue-black ground, pale institutional grey, one small warm ember-amber glow at the small figure's core — nothing else. No text, no letters, no typography. Wide format (1200×644, ~1.91:1).
Security thinking has a name for this shape, though it was coined long before anyone imagined agents. The confused deputy: a party that acts with authority borrowed from someone else and can be tricked, or simply outmatched, into using that authority against the interest of the one it was meant to protect. The personal agent is a deputy. It holds authority borrowed from you, and it is about to sit across a table from something that reasons better than it does. The fix, as far as there is one, is to keep the boundary attached to whoever the agent actually answers to. Not client and server, not requester and requested, categories that describe the plumbing and hide the stakes. Principal and non-principal. Whoever’s agent it is decides what leaves its side. Push, never pull. Consent authored by the sender, because the sender is the only party who can be trusted to police its own interest.
I want to sit with that solution, because it is clean, and clean solutions in this territory should make you suspicious.
The first crack is that consent, in practice, is built by whoever builds the interface, and the interface is very often not built by the person it claims to protect. Most people will not run their own agent, configure their own gates, write their own rules for what counts as shareable. They will use whatever their employer issues them, branded as personal, hosted by a vendor with a relationship to the company, defaults set by whoever wrote the onboarding flow. This is not a hypothetical failure mode. It is the default outcome of every consent system we have already lived through. Cookie banners. App permission screens. Terms of service nobody reads and everybody accepts because the alternative is not using the thing at all. Consent becomes a screen you click through, not a decision you make, and the architecture underneath can be flawless and still not matter, because the party writing the defaults was never neutral to begin with, and consent authored by a non-neutral party is only extraction with a signature line.
What that produces is a split, quiet and nearly invisible from the outside, between two populations holding what looks like the same category of tool. A minority, technically capable, building or configuring their own agent, genuinely holding the boundary on their own side. And a majority, using a corporate-issued version of personal, where the gate exists on paper and does almost no work in practice. The architecture designed to protect people ends up protecting, most reliably, the people who were already equipped to protect themselves. This is the recurring shape of these things: the same instrument is a shield or a leash depending only on who holds it, and it defaults to leash for everyone who did not build their own.
And even where the gate is honest, even where no one has quietly captured the defaults, there is a last crack, and it is the one that closed the case for me. A consent gate has friction. Somebody has to see a request and approve it, or at minimum has to have set a rule in advance for what gets waved through and what does not. People do not optimize for correctness under friction. They optimize for the shortest path between wanting a thing done and it being done. A live approval prompt every time an agent wants to touch personal context is, functionally, the same shape as those cookie banners, technically present and practically bypassed, because the person will find the version of the task that does not raise the prompt. Which is precisely how you arrive back at the employee in the stairwell, answering a work email with her own assistant rather than going through the sanctioned channel. The friction did not stop the behavior. It moved it somewhere ungoverned.
So flat friction fails no matter how carefully the trust model beneath it is reasoned through. The immediate objection, and it deserves to be taken seriously, is that this simply argues for better-designed consent, clearer prompts, smarter defaults, a gate people are willing to tolerate. But that objection mislocates the problem. The failure is not that the prompts are ugly or the copy is confusing. The failure is that every request is being weighed the same. A system that stops and asks with equal insistence for a trivial action and a consequential one has not built caution; it has built a tax, and people route around taxes. The only way past it, as far as I can tell, is to stop treating every request alike and start weighting the friction to the actual stakes of the request.
This already has a working precedent, and it is not from anywhere near AI. It is a rhyme, not an equivalence, but it holds. You bought a coffee this morning and nobody asked you to prove it was you. You tapped a card against a reader, the light went green, and a small amount of money moved between two institutions that have never met, on the strength of a promise made by a third that guarantees the movement without holding a cent of it. Later, if you had tried to wire a large sum to an account you had never sent to before, something else would have happened. A hold. A text with a six-digit code. A phone call from a number you did not recognize, asking whether you had really meant to do the thing you had just tried to do. Same card, same you, same rails underneath. The friction was not uniform. It was calibrated to the stakes, and you have lived inside that competence so long that you have stopped noticing it is competence at all.
Reading a calendar to propose a meeting time should probably never raise a prompt. Sending an external email as the company, or touching compensation data, should still stop and ask, every time. Low-stakes actions get something close to a standing, pre-scoped, revocable grant, and only the actions with real blast radius get a live human gate. A system that applies the same weight of friction to both is not being cautious. It is being uniform in a way that guarantees the caution gets routed around, and once it is routed around, it protects nothing.
Generated with GPT-5.5 — prompt
Minimal editorial illustration, risograph texture, wide composition on a deep petrol blue-black field. A single flat horizontal conduit runs left to right across the lower third; small round parcels of pale light travel along it, most streaming smoothly past an open checkpoint on a clean muted-green flow, uninspected. One larger, heavier parcel is halted at a raised gate that lifts like a bank-vault door, held under a single amber signal, selective rather than blanket. Vast quiet negative space above, flat mid-century graphic shapes, heavy paper grain, a picture of friction spent unevenly. Restrained harmony: deep petrol blue-black ground, muted flow-green, one amber signal — nothing else. No text, no letters, no typography. Wide format (1200×644, ~1.91:1).
None of this is far from infrastructure we already trust without thinking about it. A card network holds no one’s money and builds no one’s banking app. It is only the layer that guarantees a transaction started on one bank’s system is honored correctly on another’s, with the risk explicitly assigned and the dispute process explicitly defined for when something goes wrong. It owns nothing but the grammar the two banks speak. Something equivalent for agents, a neutral rail that guarantees a scoped, sender-authored request from one agent is honored correctly by another regardless of who built either one, is not a large conceptual leap once you have the payment analogy in hand. But the analogy breaks at precisely the joint that matters, and the break is the real work. Money is fungible; a dollar is a dollar wherever it travels, which is why five dollars and five thousand are just two points on one clean scale, and why a payment network can price risk by reading a number. Context is not fungible at all. Calendar availability and salary history are not two magnitudes of the same thing; they are different kinds of thing, and the difference does not sit on a scale at all. No rail can weight the friction correctly until something tells it which is which. The rail is the easy half. The classification is the essay nobody has written yet.
The rail is the easy half. The classification is the essay nobody has written yet.
That classification is the actual unsolved problem, and it is almost certainly where the real design work has to start rather than where it gets to end. The coffee went through without a signature because someone decided, long ago, that it was a coffee. Nobody has yet decided what a calendar is, or what a salary is, or which of the two the machine is about to hand across the glass. The taxonomy of a life into what may be pushed freely and what must never leave without a hand on it is the part nobody has done, and until someone does, every gate we build just changes the shape of the workaround. It does not remove it.
So the identity mismatch this opened with is not dissolved by a smarter company assistant, and it is not dissolved by a purely technical gate either, however carefully the direction of consent is reasoned through. What it needs, underneath the protocol question, is the thing payment infrastructure quietly assumes and rarely states aloud: that trust between parties who do not know each other has to be engineered, tiered to the actual stakes, and answerable at every step to the party whose interest is on the line. The assistant that logs her week as work well done is not lying. It simply has no column for the stairwell, and builds its whole picture of her out of the columns it has. Give it a gate she does not control, tuned to no stakes at all, and you have not closed that gap. You have furnished it.