The Wall Picks the Agent

This morning, in the space of about an hour, I watched the same question get three different answers: is my AI allowed to act for me?

Scene one: the refusal. A short note, already written, sitting in Substack's composer as a draft my assistant saved days ago. The assistant clicked Post. Substack answered: "Failed to send note. Something went wrong." No reason, no appeal, no path. We had run this exact experiment four days earlier on a brand-new session and gotten the same refusal, word for word. Today's session was aged and established. Same wall. The note will go out when I tap it myself — or when a different assistant, holding a different session, posts it for me.

Scene two: the repair. My other assistant works through a dedicated browser profile on my own machine — established sessions, the kind platforms trust. Its scheduled qualification check found one lapsed login among the ten platforms it publishes to: the dashboard of this very publication. It stopped, reported exactly what it found and what it had not done, and waited. I signed in myself. One minute, my hand, my machine. It resumed, re-ran the check, and the lane was qualified again. Nothing about that division of labor is broken. It is the design working: the agent does the work; the human performs the one act that has to prove it's the human.

Scene three: the admission. Days earlier I had asked Substack's support how delegated posting is supposed to work. Their support bot told me it is "not supported via Substack MVP/MCP." Read that sentence again. An agent interface exists. It is simply not for us.

The wall doesn't stop agents. It selects them.

Here is what the wall actually accomplished this morning: nothing was prevented. The note still gets posted — by a different agent, through a session the platform trusts more, with less visibility for the platform than a sanctioned connection would give it. The wall did not choose whether an AI acts for me. It chose which AI, and it chose the one it can see least.

That is the general shape of these defenses, and it is why I think platforms are undermining themselves with them. A wall that cannot distinguish one user's authorized assistant from a botnet does not tax abuse — the botnets never intended to ask permission. It taxes the honest: the writer whose assistant drafts in her voice, posts on her word, and keeps receipts. On Substack's side of the ledger, that writer is not a threat model. She is the supply side. The platform is taxing its own producers and calling the tax safety.

The third level

There are levels to working with these machines. At the first level, you do the clicking yourself — ten platforms, ten composers, ten sets of quirks, an evening gone. At the second, you ask the AI and then carry its work across the gap by hand, copy and paste, the clipboard as a border crossing. At the third, the agent holds the session under your standing authorization and acts: drafts, posts, verifies, reports back.

The third level has a property the platforms are not pricing in: habituation runs one way. Once you have watched an agent requalify a publishing lane, catch its own stopped fence, and hand you a receipt, the manual tour stops feeling normal and starts feeling broken. Nobody who got contacts went back to memorizing phone numbers. Nobody who got saved payments went back to typing card numbers for fun. Tolerance for friction does not recover. Every user who reaches the third level becomes, permanently, a worse customer for a first-level interface.

The fear is real. The instrument is wrong.

Platforms are not wrong to fear what agent traffic can do to a social surface. A notes feed farmed by anonymous automation is a dead feed, and everyone who builds on these platforms should want that prevented. The fear is legitimate. The wall is just the wrong instrument for it, because the distinction that matters is not human versus machine. It is authorized and accountable versus anonymous and disposable. An agent acting for an identified user, under a scoped and revocable permission, posting that user's own writing with a receipt trail, is not a smaller botnet. It is a different thing — and a platform that refuses to build the distinction will be routed around by the people who can, while remaining wide open to the people who never cared.

What the lane looks like

The alternative is not an open door. It is a governed one: permissions scoped to the task, revocable at any time, attributed to the user, rate-limited, logged. Pieces of it already exist in the wild. Bluesky issues app passwords — delegated credentials, scoped and revocable by design. My own assistant works under the same pattern: I authorize once, through a vault; the agent never sees the secret; the session runs; every action comes back with a receipt. This morning's repair ran on it. The one thing I had to do myself was the one thing that should require me.

A platform that opens that lane gains more control than any wall gives it: it can see the agent traffic, shape it, price it, revoke it. A platform that refuses keeps the traffic and loses the governance. The agent use happens either way. The only choice on offer is whether it happens in the open, under the user's name, or around the back, under nobody's.

The close

I am not arguing that Substack owes my assistant a login. I am arguing that it is spending its writers' patience to buy a security it is not actually getting — and that patience, once spent at the third level, does not refill. The platforms that open the governed lane early will inherit the agent era's distribution. The ones that don't will be routed around, one established session at a time, and will experience that as a mystery of declining engagement.

The wall doesn't stop the agent. It just picks which one — and it keeps picking the one it can't see.