The key lesson
Meta describes Muse as a personal agent that works in a dedicated secure virtual machine, asks for approval around sensitive actions, and records an audit trail. Those controls are more consequential than a chat interface because an agent that can browse, pay, and communicate can also create costly mistakes.
Model authority as a product decision
Break authority into read, draft, submit, purchase, and persist. Each level should have an explicit policy. A one-time payment token and a confirmation before an email are useful patterns because they limit blast radius. The same principle applies to calendar changes, data exports, and contract acceptance.
Design for revocation
Users need to see connected services, remove access quickly, inspect actions, and correct memory. The operational test is simple: can a person understand what the agent did and stop it without relying on support? If not, the autonomy claim is ahead of the control system.
FAQ
Is a secure VM enough? No. Isolation must be paired with authorization policy and human review. Should agents have persistent memory? Only when people can inspect and delete it.