AI Agents at Work Have Logins but No Job Descriptions

Two stories published within hours of each other this week describe the same gap from opposite ends. The Taipei Times asked where the employee handbook is for Taiwan's new AI coworkers. Koreabizwire reported that companies are hitting a fresh class of security problem as agents move from demos into production workflows. Put together, they describe an organizational fact that most AI adoption dashboards miss: agents are being provisioned like software but they behave like staff, and almost nobody has written the rules.

That gap is not an abstract governance issue. It lands on individual contributors as unbudgeted work: deciding what an agent is allowed to touch, checking what it did, and cleaning up when it does something confidently wrong. This is the part of AI at work that is genuinely changing day-to-day jobs right now, and it is quietly eating a share of the productivity gains that leadership decks already booked.

AI agents at work arrive without a personnel file

When a contractor joins a team, they get a scope of work, a named manager, a start and end date, and an offboarding checklist. When an agent joins the same team, it typically gets an API key, an OAuth token scoped to whatever the authorizing employee could already access, a Slack seat, and sometimes a spend limit on a cloud account. It rarely gets a written scope, an owner of record, or a decommission date.

The asymmetry matters because agents act. A retrieval chatbot returns text a human can ignore. An agent files the ticket, merges the branch, updates the CRM record, emails the vendor, or moves the money. The permission model was designed for tools that wait to be told what to do, and it is now backing entities that decide sequences of actions on their own.

This is why the handbook framing from Taipei is more useful than another maturity model. The questions that matter are ordinary HR questions applied to software: who owns it, what is it allowed to do, how do we know what it did, and how does it leave.

Non-human identity is becoming the new insider risk

The security problem Koreabizwire flagged is not exotic. Agents inherit the entitlements of whoever authorized them, which in most companies means a senior engineer or an operations lead with broad standing access. An agent with a long-lived token and a permissive scope is an insider account that never sleeps, never gets a performance review, and cannot be socially trained out of a bad instruction.

Prompt injection turns that into a live attack surface. A support agent that reads customer tickets is reading untrusted input. A coding agent that pulls in a dependency README is reading untrusted input. The blast radius is set entirely by what the credential allows, and in most deployments nobody has audited what it allows since the pilot.

Teams that have written something resembling a handbook converge on the same short list of clauses.

• A named human owner for every agent, listed in the same directory as employees
• A written scope of authority, including actions the agent must escalate rather than take
• Least-privilege credentials with expiry dates, not standing tokens copied from a personal account
• A queryable action log that a non-engineer can read during an incident review
• A decommission trigger, so retired agents lose access instead of running unattended

The supervision tax is where productivity claims leak

Agents shift the shape of work from producing to reviewing, and review time is systematically underestimated. Reading a 300-line agent-generated pull request to the standard where you would sign your name to it often costs more than writing 80 lines yourself. The same holds for a reconciliation the agent completed, a customer email it drafted, or a data pull it assembled from three systems.

That cost is real but invisible in most measurement schemes, because tool adoption is easy to count and verification effort is not. It also explains part of the credibility problem around AI-attributed job cuts. Monday.com joined roughly 20 other companies in citing AI when trimming headcount, and Robinhood's note accompanying its 10 percent reduction showed that investors and staff have stopped taking the attribution at face value.

The counterweight is that oversight itself creates work. Lloyds reported this week that AI is creating more UK jobs than it eliminates, and a meaningful share of what gets created sits in review, integration, and control functions rather than in model building.

Which tasks agents are actually absorbing

The absorption pattern is consistent across the deployments being described publicly. Agents take over first-draft generation, ticket triage and routing, log and meeting summarization, test scaffolding, routine data pulls, and repetitive reconciliation between systems. These are tasks with clear inputs, a checkable output, and a tolerable error cost when a human reviews before commit.

What is not moving is work that requires holding ambiguity, negotiating across teams with competing incentives, or accepting personal consequence for a decision. That is why engineering roles have held up better than the 2024 predictions suggested, and why the shortage is now in people who can specify and verify rather than people who can type quickly.

The demand signal is showing up outside engineering too. Reporting this week noted a surge in AI skill requirements in nontech roles, and Inc. made the case that the strongest candidate for a technical job is often not a computer science major. Finance, marketing, legal operations and HR are the functions where a single well-scoped agent can absorb the largest share of a workflow, and where nobody has been trained to supervise one.

Owning the agent beats racing the agent

The psychological backdrop is worsening faster than the labor data. HR Dive reported workers describing FOBO, a fear of becoming obsolete. Pew found young adults in the US increasingly wary that AI will take their jobs. Research summarized by zoomer.com found that AI training can backfire for older workers through technostress, producing avoidance rather than adoption.

The strategic response is not to out-produce an agent at drafting. It is to become the person who defines what the agent may do, checks that it did it, and answers for the result. Ownership positions are durable precisely because they carry accountability, which is the one thing no vendor is currently offering to take off your hands.

That reframing also fixes the training problem. Learning another prompt technique has a short half-life. Learning how to scope, permission, log and audit an autonomous process is closer to a transferable operations discipline, and it applies whether the underlying model changes vendors next quarter or not.

What to do in the next 90 days

Treat the missing handbook as an opening rather than a complaint. In most organizations, no one has been assigned this work, which means the first person to do it credibly defines the standard and gets named in the process. That is a rare kind of visibility in a year when TikTok is closing offices, Patreon has cut 20 percent, and Pentera has run two rounds in four months.

Start narrow and documented. One agent, one workflow, one written scope, one owner, one review log. A single working example is worth more in a performance review or an interview than a general claim of AI fluency.

• Inventory the agents already running in your team's workflows, including ones spun up during pilots and never turned off
• Find out which human credential each one is borrowing, and whether that token expires
• Write a one-page scope document for the agent you rely on most, including the actions it must escalate
• Track your own verification time for two weeks, so you can argue about productivity with numbers instead of impressions
• Log one incident review where an agent produced a wrong result, what it cost, and what control you added
• Put the artifacts, not the tool names, on your resume: scope docs, audit logs, escalation policies