# Who owns the words: what changed in v1.2.0, sgit.ai > The changes to the article "Who owns the words" in v1.2.0, paragraph by paragraph. *Source: · site v0.7.86 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [Who owns the words](../../who-owns-the-words.md) / [Versions](../who-owns-the-words.md) / v1.2.0 # Who owns the words: what changed in v1.2.0 From v1.1.0 (2026-10-13, `2a4142507`) to v1.2.0 (2026-10-13, this release), paragraph by paragraph. 7 paragraphs added, 4 removed, 1 changed in place, 41 unchanged. About 500 words added and 237 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [← v1.1.0](v1.1.0.md) · [all versions](../who-owns-the-words.md) 1 unchanged paragraph Summary: One of the early users of the agentic workflow behind agent@riskmandate.ai wrote back with a question I think matters a great deal in 2026. If the agents only gather and draft, and I review, sign off and press send, does presenting them as a team imply an agency they do not have? What a recipient needs is to know who owns the decisions and the responsibility, and to talk to that person. Would they ever need to addressgo to the agentsagents,directly?around me? And if so, what can the agents do without me? This is my answer. What we have today are not sentient beings; they are far richer than "predicting the next word", and they are mirrors that can simulate any emotion, which is why we anthropomorphise them, as people did with ELIZA in the sixties. Since models started running in loops and calling tools, they make real decisions. Responsibility does not travel with those decisions. It stays with whoever granted the reach and set the mandate, which is RiskMandate's line: the moment of authorisation is the grant. TheTalkingcase for addressingto the agents directlyis normal; going around me is not, and the only party who would try is an attack.attacker with an injected instruction. What the agents may do without me is a separate question, answered in advance by a published policy. The disclosure is not a team to manage; it is a label on how the words were made, because people and models should read machine-written text differently. The best analogy is an employee with a job description, and an Agent Behaviour Policy is that job description, published. And the fluent writing these agents produce was never the real value. 6 unchanged paragraphs, under In short {#in-short} • **The only reason to address the agents directly is that something has gone wrong.** That is an attack, prompt injection, not a conversation. • **Talking to the agents is normal. Going around me is not.** Nobody legitimate needs the agents to act without the accountable person; the only party who would try is an attacker, with an injected instruction. • **What the agents may do without me is a different question.** It is answered in advance, by me, in a published policy, which is an authorisation, not a bypass. 14 unchanged paragraphs, under The question {#question}, What we have today {#models}, Decisions without responsibility {#decisions} ## When would you talk to the agents directly? {#directly} So, the probing question. Is there a case where you need to address the agents without me? I think the honest answer is: only when something has gone seriously wrong. If someone is trying to get the agent to do something its owner does not want, that is not a conversation; it is an attack, the territory of prompt injection. An agent that takes instructions from the people it writes to, rather than from the person accountable for it, is an agent that has been subverted. That does not make the follow-up question go away, and I think it is the better question: what can the agents do for you without my full sign-off? Today, nothing that leaves the building. Every draft passes [a second reader the agent cannot skip](../../../articles/a-second-reader-the-agent-cannot-skip.md), and the agents never send; I do. Inside the building they can do a lot that is useful to a recipient: research, summaries, materials, notes that keep a long thread coherent, a first draft that saves you reading three emails to understand one. The right answer to "what can they do without you" is not a sentence in an email. It is a published behaviour policy, so you can read the answer yourself. ## Talking to the agents, and going around me {#directly} The probing question contains two questions, and it is worth separating them, because they have opposite answers. The first is whether you talk to the agents at all. You do, and that is fine. When you write to agent@riskmandate.ai, an agent reads your email, gathers what it needs, and drafts the reply I review. You are already talking to the agent; it is part of how the work gets done, the same way a letter to an office is read first by whoever opens the post. The second is whether you would ever need to go to the agents around me: to get them to decide, commit or send something without the person accountable for it. The answer is no, and I mean it as a design property, not a forecast. Nobody with a legitimate reason needs the agents to act behind the accountable person's back, because anything legitimate can come to me. The only party who would try to make an agent act on instructions that did not come from its owner is an attacker, and the way they try is an injected instruction: text in an email, a document or a web page, written to look like a request the agent should obey. That is prompt injection, and the right response is not to make it rare. It is to make it impossible to succeed, which is why the agents never send, and why every draft passes [a second reader the agent cannot skip](../../../articles/a-second-reader-the-agent-cannot-skip.md). What is left is the question the email asked next, and it is the useful one: are there things the agents can do for you without me in the loop each time? That is not going around me. It is something I decide in advance, once, and write down: these kinds of questions the agents may answer on their own, these they may prepare, and these always come to me. Today the answer is short. Nothing leaves the building without me. Inside the building the agents do a lot that is useful to you: research, summaries, materials, notes that keep a long thread coherent, a first draft that saves you reading three emails to understand one. If the list grows, it will grow because I authorised it, and the place to read it should be a published behaviour policy, not a sentence in an email. 20 unchanged paragraphs, under Why say it at all {#disclosure}, An employee with a job description {#employee}, Diversity, briefly {#diversity}… [← v1.1.0](v1.1.0.md) · [all versions](../who-owns-the-words.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://sgit.ai/articles/versions/who-owns-the-words/v1.2.0.html)*