Name who supervises before the agent acts alone.

Approvals off is not the same as supervised

Robinhood's HOOD Summit announcement is useful weather, not a product review. The company described in-app agents that research, build strategies, and place trades. Customers can leave trade approvals on, so each proposal still needs a human, or turn them off so the agent may place eligible trades without confirming every order. Coming soon: Loops—standing instructions that may place, modify, or cancel trades on a schedule, including while the user sleeps. Public disclosures are blunt: customers assume all risk for agent trades and for third-party LLM data use, and Robinhood "does not control, supervise, monitor, recommend, or audit agents." Turning Loops off does not reverse trades already placed. Pair that with elevated crypto perpetual risk when leverage and unattended automation meet, and the picture is clear enough.

We are not here to dunk on a brokerage product. The same toggle pattern shows up wherever teams ship commerce or ops agents that can move money or leave irreversible side effects. Someone demos the happy path with approvals on. Someone else asks for "less friction." Approvals go off. The deck still says "human in the loop" because a human exists somewhere in the org chart.

That is not supervision. That is a setting.

The operating question for readers building AI applications & agents—or wiring agents into ecommerce paths that can charge, refund, ship, or rewrite durable records—is simpler: before the agent may act alone, who supervises, what gets audited, how do you stop it, and what happens when those answers are missing?

A risk disclaimer is not an operating control

Legal and product teams will write truthful sentences. Customers assume the risk. The platform does not supervise or audit the agent. Those lines protect the vendor. They do not tell your operators what to do on Tuesday when an unattended run books the wrong refund, ships the wrong SKU, or places a trade you cannot unwind while you sleep.

Three different things get collapsed into one vague phrase: "we're careful."

Capability. The agent can call tools that move money or change state—place order, issue refund, mark shipped, update inventory, cancel a reservation.

Approval setting. Per-action confirmation is on or off. Off means the agent may execute without a human click on each step.

Supervision. A named owner watches outcomes on a defined cadence, an audit trail records what the agent did and why it was allowed, a kill switch can halt further execution, and a written rule refuses unattended runs when any of those are missing.

A disclosure that says nobody audits the agent answers the second party's liability question. It does not fill your third column. If your go-live checklist only asks "did legal review the disclaimer?" you will ship unattended execution with no owner, no trail, and no stop.

Treat platform language as a reminder. When a vendor says it does not supervise, that is your cue to name who does—inside your company, for your agent jobs.

What you name before the agent may act alone

Pull one real agent job that can spend, trade, ship, refund, or change durable state—or that will within a quarter. Walk these fields before you allow approvals-off (or your stack's equivalent). Later you can keep them on one Agent Supervision Owner Card if that helps the team; the names matter more than the stationery.

Agent job. Stable id both runtime and operators share: ops.refund.propose-and-post, commerce.replenish.overnight, treasury.rebalance.loop. If the only name is a Slack channel or a model nickname, you cannot revoke the right job when something goes wrong.

Consequential actions. The verbs that may not run unattended without this card: which tools, which amount or severity thresholds, which environments. Read-only research can stay wide. Writes that move money or external commitments stay narrow until supervision is real.

Supervision owner. Role, not "platform" and not "the model." Who is accountable for watching this job's outcomes? Who gets paged when audit alerts fire? Who may raise or lower the unattended ceiling? Write a human-backed role that answers email after hours if the job runs after hours.

Audit trail. What must be logged for every consequential action: who/what initiated it, which policy or approval state allowed it, inputs the agent used, tools called, amounts or identifiers touched, timestamp, and correlation id an investigator can follow. "We have chat history" is not an audit trail unless chat is the designed system of record—and it usually is not.

Kill switch. How unattended execution stops within a named bound: disable the job, revoke the tool broker token, freeze the Loop-equivalent, cut the credential. Turning a UI toggle off must not leave in-flight work you cannot see. Say what already-placed actions do not reverse—so nobody confuses "paused" with "undone."

Refuse-without-supervision rule. Explicit: may not run approvals-off (or continuous loops) when owner is vacant, audit trail is dark, kill switch is untested, or the job is still in first production week. Soft "escalate if unsure" with an empty on-call is not refusal—it is hope.

Cadence and review artifact. How often the owner reviews runs (every N actions, every shift, daily digest), and what artifact proves the review happened. Unattended without a review cadence is just hoping the demo keeps working.

Forbidden paths. Approvals off with no named owner; continuous loops with no kill drill; "supervise" meaning a weekly vibe check of screenshots; logging only successes; relying on a vendor statement that they do not audit agents as if that were your control.

Walk one dry run: plant a bad consequential action, confirm the trail captures it, page the owner, and hit the kill switch. If any step is theater, you do not have supervision—you have a story about one.

How unattended fails when nobody owns the watch

Composites—not brokerage loss rates, not client incident counts, not invented ROI from "removing friction."

The empty on-call. Approvals off for overnight replenishment. The runbook says escalate if unsure. Nobody is scheduled. The agent is sure. Morning finds orders you will not reverse with a toggle.

The chat-as-audit myth. Someone points at a transcript and calls it the trail. The transcript lacks tool ids, amounts, and which policy gate opened. Dispute arrives; you reconstruct from memory.

The pause that does not undo. A Loop-style job is paused after a bad streak. Positions, shipments, or refunds already submitted stay submitted. The team thought pause meant rewind. Public product copy already warns that turning automation off does not reverse what ran. Your internal jobs need the same honesty in the kill-switch field.

The disclaimer as comfort. Leadership reads that the platform does not supervise agents and feels oddly safer—"at least it's disclosed." Disclosure moved risk; it did not assign a watcher on your side.

The leverage multiply. A small automation error is tolerable at 1x. The same error under high leverage, high refund authority, or bulk ship confirmations is not a small error. Unattended plus high blast radius is a different job—treat it as one on the card.

The borrowed supervision. "Finance looks at the dashboard" with no owner line, no cadence, and no kill path tied to that dashboard. Looking is not supervising unless the card says so and the page lands on a person who can stop the job.

When you see these, do not add another courtesy sentence to the system prompt. Close the fields: owner, trail, kill switch, refuse rule, cadence. Headlines can summarize agents that trade while you sleep. They cannot name your owner or prove your stop works.

Not spend ceilings, not sandboxes, not model scorecards

Keep the layers separate so reviews stay honest.

Checkout or spend authority answers: may this agent complete a charge, under what ceiling, credential, and intent proof? Needed before money leaves. It does not say who watches overnight runs or how you halt a Loop-equivalent.

Containment answers: what must stay unreachable even if the agent tries—networks, mounts, prod APIs? Needed for blast radius. A sealed room can still host an unsupervised write inside the room with no trail.

Decision inventory answers: which classifier or agent decisions exist and who owns each? Useful for mapping judgment. It is not a kill switch.

Model job gate answers: does this model clear a job-shaped acceptance pack before you buy or route it? Needed before you trust the brain. A passing eval does not supervise production actions.

Supervision ownership answers: who is accountable while the agent acts alone, what audit evidence must exist, how execution stops, and when unattended is refused.

An agent can have a tight spend ceiling and still run unattended with nobody on watch. It can sit in a sealed sandbox and still post irreversible state inside that sandbox with no trail. Fixing ceilings or walls does not invent a supervisor. If your review board only asks "what's the limit?" or "is it isolated?" you will miss the approvals-off job that nobody owns after 6 p.m.

Put this into practice

1. List every agent job that can spend, trade, ship, refund, or change durable state—including ones that still have per-action approvals on today.
2. For each job that may ever run approvals-off or on a continuous loop, walk the supervision fields: owner, consequential actions, audit trail, kill switch, refuse-without-supervision rule, review cadence, forbidden paths.
3. Refuse unattended go-live until the owner role is staffed for the hours the job runs, the trail is queryable for a planted action, and the kill switch has been fired once on purpose.
4. Write explicitly what pause/disable does not reverse. Align operators and support macros with that sentence.
5. Keep spend authority, containment, decision inventory, and model acceptance as separate cards. Do not pretend one checklist covers supervision.
6. If the gap is designing agents that act inside real commerce or ops systems with supervision you can defend—not another demo of an agent that "just works overnight"—bring the named fields into a scoping conversation for AI applications & agents and, when the side effects are storefront-shaped, ecommerce.

A toggle that turns approvals off is a capability switch. A named owner, a real audit trail, a tested kill switch, and a refuse rule are operating controls. Name who supervises before the agent acts alone.

Related work: Spin Market.