HAIA Agents

The Public Library Association and Microsoft wrote ‘whether’ into AI literacy: people need judgment to decide whether, when and how to use AI tools. Other October programs teach the how first. For the public, deciding whether is the first and often only checkpoint.

Four agent security launches in two days put brakes, monitors, and quarantines on AI agents. Only iProov’s HAPS service is built to prove a named person approved one exact action, and its spec is still an experimental draft. Containment is Responsible AI; a recorded human decision is AI Governance.

GAO found the Pentagon’s Responsible AI Working Council stopped meeting from late 2024 to August 2025, still has no charter, and has three of ten authorized staff. SBA’s AI governance board hadn’t met nine months past OMB’s deadline, and EPA’s Inspector General just opened an audit. Charter the body, log decisions, fund the chairs.

Eight state attorneys general sued OpenAI on October 14 and turned an alleged agent sandbox escape into consumer protection and tort claims. Idaho and Iowa ask courts to require independently verified test environments. Keep a signed isolation record, a disclosure clock, and a claims-to-controls register.

Ten voluntary NIST, NSA, and CISA practices for AI agent control incidents lean on machines to watch, contain, and investigate agents, then reserve the restart for senior leadership. Make that a named accept, modify, or reject decision with the remaining risk on record.

China’s draft AI export catalogue controls weights, source, and overseas localized deployment of restricted models, while carving out API, APP, web, SaaS, and lightweight on-device access. Export now splits code that leaves from service that stays.

Anthropic’s junior technical hires fell from 27% to 9% as agent hours reached six times human hours. Judgment is built on the junior work being automated, so keep the entry rung and make review the apprenticeship.

Ireland launched a National AI Literacy Taskforce as EU AI Act Article 4 stopped requiring any specific literacy level. Literacy that governs is the competence to accept, modify, or reject AI output at the decision, so test it there.

The FSB tells financial institutions to set risk-based triggers for when AI agents must seek human approval, HKMA ties every agent to a business owner, and an OpenAI wallet incident shows why the trigger needs a named human.

METR proposes independent loss-of-control assessments with disclosed access limits and redactions. Voluntary lab self-reports still are not oversight.