The Agent Needs a Chaperone

The week’s AI story is not that models are getting more capable. That press release has been running continuously since somebody first taught a GPU to autocomplete a for-loop. The consequential development is that organisations are trying to let models touch things: research corpora, live data, compliance workflows, software systems, perhaps eventually the machinery that keeps a civilisation’s communications layer from having a very bad afternoon.

That is why the unglamorous work is becoming the work. A new architecture proposal for agentic data systems argues for contracts, freshness checks, semantic models, delegated permissions, audit trails and staged autonomy. Its useful aphorism is: “A human hesitates at data that looks wrong; an agent acts on it anyway”. Exactly. The machine has no gut feeling, only an execution path and the serene self-confidence of a spreadsheet that has never met a customer.

Federal medical organisations offer a more sober preview of the arrangement. The NCI, Argonne and FDA deployments described this week use LLMs for scientific discovery, secure internal access and document review, but keep experts in the loop. FDA’s Elsa reportedly filters and categorises direct-to-consumer advertising risks; agency experts review the outputs and discard some. This is not the robot scientist replacing the lab. It is a tool being made to earn its badge, one rejected suggestion at a time.

Before an agent can make a questionable decision from a pristine semantic layer, it must first establish TLS. The OpenAI Python SDK’s migration guide says its synchronous and asynchronous clients are moving from HTTPX to HTTPX2. Default SDK users should retain familiar calls, streaming, retries and response models. Everyone who owns a custom client, proxy, tracer, mock, transport subclass or carefully cultivated corporate certificate arrangement has received a small assignment disguised as a dependency upgrade.

The sharp edge is the trust store. HTTPX2 uses the operating system’s TLS trust store, rather than the certifi bundle HTTPX used; certifi is no longer installed by the SDK. As the guide puts it, “HTTPX2 changes the default TLS trust store, including for applications that use the SDK's default HTTP client.” Minimal containers without system CAs and TLS-inspecting proxy environments are specifically identified as places where verification can fail. In other words, the model may remain perfectly capable, while the plumbing discovers theology.

The escape hatch is deliberately uncomfortable: applications can install and inject legacy HTTPX clients, but “Legacy HTTPX support is runtime-only,” and is explicitly a migration aid that may disappear. That is a reasonable posture. Compatibility shims are scaffolding, not a load-bearing floor. Still, this episode is a reminder that AI adoption lives in the dependency graph, not the keynote: test interceptors, raw response types, middleware, environment variables and the certificates nobody documented because they were installed by a person who left in 2021.

Meanwhile, Z.ai announced on X that GLM-5.3 is now open-weight, describing it as its most capable model for agentic coding and cyber defence and saying users can download, run and customise it. The announcement supplies neither benchmarks nor technical specifications nor licensing terms in the material here, so the responsible conclusion is both modest and important: a set of weights has been made publicly available, and the rest remains homework.

Open weights alter the procurement and deployment conversation. They can let teams run a model inside their own environment and customise it. They do not, by themselves, supply identity boundaries, tool permissions, fresh business data, incident procedures, evaluation harnesses, or an answer to the age-old question of who gets paged when the autonomous coding assistant develops a novel interpretation of delete.

The Martin Fowler proposal is unusually good on this point. It recommends moving through shadow mode, supervised use, guarded autonomy and only then fuller autonomy; it also urges short-lived credentials and capabilities designed around business operations rather than every underlying endpoint. “Five to ten well described business capabilities will outperform 50 thin API wrappers almost every time.” This is less glamorous than wrapping the entire service catalogue in MCP and calling it an agent platform. It is also how one avoids building a very expensive, exquisitely authenticated vending machine for production incidents.

Not every promising application is a chatbot with access to an internal wiki. Researchers at NJIT report that EarlyDetect, a Transformer-based model using NASA Solar Dynamics Observatory data, identified precursor signals for solar active regions an average of 9.24 hours before associated activity became visible in testing. That is a serious use of pattern recognition: take a system whose relevant structure develops below the visible surface and look for signals humans cannot directly see.

The wording matters. The reported result is an average detection lead in tests, not evidence of an operational system that forecasts severity, exact timing, false alarms or consequences on Earth. As project co-author Alexander Kosovichev explains, “The main difficulty is that an active region begins developing beneath the Sun's visible surface, where we cannot directly observe the magnetic structure,”. The limitation is refreshingly physical. No prompt template can negotiate with the photosphere.

Yet the solar story clarifies the distinction the industry keeps smearing into one word, AI. A model that surfaces an earlier signal can be valuable even if it does not take an action. In medicine, agencies are using models to reduce research and document-handling drudgery, not to replace scientific judgment; as one researcher put it, “We aren’t trying to use these models to replace scientists. We’re trying to augment some of the more tedious parts of our workflows.” In operations, the same discipline applies: detect, explain, verify, then decide who—or what—may act. The future may be agentic. The safe version still has receipts, permissions, and a human who knows where the big red button is.