功夫可以下載，責任不行

今年最常聽到的詞是 agent，但每個人說這個詞的時候，心裡畫的邊界都不一樣。有人想的是幫忙擬 email 的助理，有人想的是可以自己簽約、自己付款的軟體。很多關於 agent 的爭論吵不出結果，是因為兩個人從不同的起點出發。

The word of the year is "agent," and everyone who uses it draws the boundary somewhere different. One person means an assistant that drafts emails. Another means software that signs contracts and pays invoices on its own. A lot of arguments about agents go nowhere because the two people started from different places.

我想找一個大部分人都看過、又能把起點對齊的東西，最後找到一部 1999 年的電影。

I went looking for something most people have seen that could line those starting points up, and ended up with a film from 1999.

兩個世界

Two worlds

《駭客任務》裡，機器擁有整個世界，也訂下所有規則。人在裡面行動，靠的是下載來的能力。Neo 躺在椅子上，幾秒鐘學會一套又一套功夫。Trinity 要開一架她不會開的直升機，就向船上的操作員要一份駕駛程式，載入，起飛。

In The Matrix, machines own the world and write all of its rules. Humans act inside it with abilities they download. Neo lies in a chair and learns one fighting style after another in seconds. Trinity needs to fly a helicopter she has never flown, so she asks the ship's operator for a pilot program, loads it, and takes off.

這部分很像今天的 agent。能力越來越像可以安裝的東西：一個 skill、一組工具、一把 API key，裝上去就會。

That part looks a lot like agents today. Capability is turning into something you install: a skill, a set of tools, an API key. Plug it in and the agent can do the thing.

但電影同時訂了一條規則，而這條規則才是重點。Neo 第一次在訓練程式裡跳樓失敗，醒來時嘴裡有血。他以為那些都不是真的。Morpheus 告訴他：在 Matrix 裡死了，現實中的身體也活不了。

The film also sets a rule, and that rule is the point. The first time Neo fails a jump in a training program, he wakes up with blood in his mouth. He thought none of it was real. Morpheus tells him that if you die in the Matrix, your body dies too.

能力可以下載，後果不行。後果會穿過那條線，落在椅子上那個人身上。

Capability downloads. Consequences don't. They cross the line and land on whoever is lying in the chair.

把主從倒過來

Flip the roles

電影裡是機器當主人、人去行動。今天的 agent 剛好相反：人擁有環境、訂規則，AI 去行動。把幾種安排排在一起看，主從關係換來換去，有一件事沒變：流血的都是人。

In the film, the machines are in charge and humans act. With today's agents, it's the other way around: people own the environment and set the rules, and the AI acts. Line the arrangements up and the roles keep changing, but one thing doesn't: the one who bleeds is human.

情境Arrangement	誰擁有環境、訂規則Owns the world and its rules	誰在行動Acts	誰流血Bleeds
今天的 AI agentToday's AI agents	人People	AI	人People
電影裡的紅藥丸船員The red-pill crew in the film	機器Machines	人People	人People
Agent Smith 出手Agent Smith acts	機器Machines	機器Machines	被他附身的路人The bystander he took over

電影裡唯一死不了的，是機器自己的 agent。Neo 讓地鐵列車撞上 Agent Smith，Smith 轉眼就從另一個人身上回來。他死不了，所以什麼險都敢冒。今天的 AI agent 也有這個特質：失敗了可以無限重試，它自己不付任何代價，每一次失敗的成本都落在某個人身上。

The only one in the film who can't die is the machines' own agent. Neo puts Agent Smith in front of a subway train, and a moment later Smith is back in someone else's body. He can't die, so he will take any risk. AI agents today share that trait. They can retry forever at no cost to themselves, and every failed attempt costs somebody something.

能下載的，與不能下載的

What downloads, and what doesn't

回頭看電影，哪些東西能下載、哪些不能，其實分得很清楚。

The film is clear about what downloads and what doesn't.

能下載的What downloads

功夫Kung fuNeo 幾秒鐘學會一套又一套武術。Neo loads one fighting style after another in seconds.
駕駛直升機Flying a helicopterTrinity 臨時向 Tank 要了 B-212 駕駛程式。Trinity asks Tank for a B-212 pilot program on the spot.
知道路怎麼走Knowing the path資訊和知識都能載入。Information and know-how can be loaded.
存取權AccessZion 主機的密碼，可以從 Morpheus 腦中挖出來。The Zion mainframe codes can be pulled out of Morpheus's mind.

不能下載的What doesn't

選擇Choice紅藥丸要 Neo 自己吞，Morpheus 只能指給他看門在哪裡。Neo has to take the red pill himself. Morpheus can only show him the door.
真的去走Walking the pathMorpheus 提醒 Neo：知道路，和走在路上，是兩回事。Morpheus warns Neo that knowing the path and walking it are different things.
授權Authorization挖到密碼的人，不會因此就有權使用它。Getting hold of the codes doesn't give anyone the right to use them.
後果Consequence跳樓程式失敗，Neo 醒來嘴裡有血。Neo fails the jump program and wakes with blood in his mouth.

換成今天的說法：把 API key 交給 agent，你給出去的是存取權。授權和責任，還留在你身上。

In today's terms: hand an agent your API key and you've given it access. The authorization, and the accountability, stay with you.

誰坐在椅子上

Who's in the chair

所以我開始用一個問題，取代「這個 agent 能做什麼」：誰坐在椅子上？

So I've started replacing "what can this agent do?" with a different question: who's in the chair?

椅子是電影裡現成的道具。船員躺在椅子上、插著線進入 Matrix，操作員 Tank 在旁邊看著他們的身體。後來 Cypher 背叛，就是在現實裡拔掉線殺人。坐在那張椅子上的人，就是事情出錯時付代價的人。

The chair comes straight from the film. The crew lies in chairs aboard their ship, plugged in, while Tank, the operator, watches over their bodies. When Cypher turns on them, he kills them by pulling the plug in the real world. Whoever is in that chair is the person who pays when something goes wrong.

把電影和今天的 agent 放在同一張表上，只需要四個角色：

Four roles are enough to put the film and today's agents in the same table:

角色Role	電影裡In the film	今天的 agent 世界With today's agents
規則擁有者Rule owner	機器The machines	平台、模型供應商Platforms and model providers
委託人Principal	Morpheus 與 ZionMorpheus and Zion	下指令的使用者或公司The user or company giving instructions
行動者Actor	Neo、TrinityNeo and Trinity	AI agent
椅子上的人The chair	躺在船上、插著線的身體The bodies plugged in aboard the ship	出事時付代價的人Whoever pays when it goes wrong

判斷只有一個：椅子上的人，是不是委託人？

There is only one test: is the person in the chair the principal?

大部分時候是。麻煩在不是的時候。Neo 和 Trinity 為了救人，在一棟大樓的大廳裡射倒一整排警衛，那些警衛從來沒同意被捲進這場任務。換成今天：一個替公司付款的 agent 把錢付錯了對象，付代價的除了公司，還有一家該收到錢卻沒收到的供應商，而它從頭到尾沒參與這件事。椅子上的人不是委託人，就要亮紅燈。

Most of the time, yes. The trouble starts when it isn't. To rescue Morpheus, Neo and Trinity shoot their way through a lobby full of guards who never agreed to be part of the mission. The modern version: an agent that pays a company's invoices sends the money to the wrong place, and the cost falls on the company and on the supplier who should have been paid, which had no part in any of it. When the person in the chair isn't the principal, raise a flag.

這件事我自己遇過。去年我讓寫作 agent 幫我起草、發布文章，今年回頭逐篇核對，發現它替我寫進了幾個從來沒推出過的產品。文章掛的是我的名字。那時坐在椅子上的是我，不是它。後來我在發布前加了一道關卡，細節寫在另一篇文章裡。

I found this out firsthand. Last year I let a writing agent draft and publish articles for me. When I went back this year and checked them one by one, I found it had credited me with products that were never launched. My name was on those articles. I was the one in the chair, not the agent. I've since added a check before anything gets published; the details are in another piece.

一張九格的 canvas

A nine-cell canvas

我把這套想法整理成幾樣工具。它們原本是為一場半天的 workshop 設計的，一個人拿來檢查自己的 agent 也行。

I've turned the idea into a few tools. They were designed for a half-day workshop, but they work just as well for one person checking their own agents.

第一樣是一張九格的 canvas，一個 agent 填一張。先拿電影場景練手，再填你工作上真的在跑的 agent。中間那格最重要：說不出椅子上坐的是誰，這個 agent 就越界了。

The first is a nine-cell canvas, one sheet per agent. Practice on a scene from the film, then fill one in for an agent you actually run at work. The center cell matters most: if you can't say who is in the chair, the agent has crossed the line.

任務Task

agent 要做什麼？What is the agent doing?

電影：救出 MorpheusFilm: rescuing Morpheus

下載的能力Downloaded capability

用了哪些 skill、工具、存取權？Which skills, tools and access does it use?

電影：功夫、B-212 駕駛程式Film: kung fu, the B-212 pilot program

規則擁有者Rule owner

在誰的環境裡？照誰的規則？Whose environment? Whose rules?

電影：機器；有些規則能彎，有些能破Film: the machines; some rules bend, some break

委託人Principal

它替誰做事？Who does it work for?

電影：Zion；Cypher 中途換邊Film: Zion; Cypher switches sides

誰坐在椅子上Who's in the chair

出事誰付代價？這個人同意了嗎？Who pays if it goes wrong? Did they agree to it?

電影：船上插著線的身體Film: the bodies plugged in aboard the ship

偽裝風險Disguise risk

誰可能是 Agent Smith？（指令注入、劫持）Who could turn out to be Agent Smith? (prompt injection, hijacking)

電影：紅衣女子Film: the woman in the red dress

出口Exit

做錯了怎麼撤回？怎麼退出？How do you undo it? How do you get out?

電影：有線電話出口Film: the hardline phone exits

不能下載的Not downloadable

哪些選擇和授權，只能由人來做？Which choices and approvals stay with a person?

電影：紅藍藥丸Film: the red and blue pills

EMP 停機EMP (kill switch)

緊急停下來時，還會傷到誰？If you hit stop, who else gets hurt?

電影：EMP 會連自己的船一起癱瘓Film: the EMP knocks out the ship's own systems too

示範：一個替公司付供應商款項的 agent（示意，非真實案例）

Worked example: an agent that pays supplier invoices (illustrative, not a real case)

任務Task: 比對發票並付款給供應商，單筆上限 5,000 美元。Match invoices and pay suppliers, up to US$5,000 per payment.
下載的能力Downloaded capability: ERP 讀寫權限、銀行付款 API key。Read and write access to the ERP; a bank payment API key.
規則擁有者Rule owner: 銀行、ERP 廠商。The bank and the ERP vendor.
委託人Principal: 財務團隊。The finance team.
誰坐在椅子上Who's in the chair: 簽核付款的財務長。錢付錯對象時，還有供應商，這是第三方，要亮紅燈。The CFO who signs off. If money goes to the wrong place, the supplier too. That's a third party: raise the flag.
偽裝風險Disguise risk: 夾帶隱藏指令的假發票 email。A fake invoice email carrying hidden instructions.
出口Exit: 每批放款前的保留時段；可撤回付款的期限。A hold period before each batch goes out; a window for reversing payments.
不能下載的Not downloadable: 新增供應商、修改收款帳號。Adding a supplier; changing bank details.
EMP 停機EMP (kill switch): 全面凍結付款，所有供應商都會延遲收款。Freezing all payments delays every supplier.

一張邊界地圖

A boundary map

第二樣是一張邊界地圖。把 canvas 上這個 agent 會做的每個動作，一個一個貼上去：橫軸是做了能不能撤回，縱軸是後果留在數位層，還是落在人身上。

The second tool is a boundary map. Take each action the agent on your canvas performs and place it on the map: across, whether it can be undone; down, whether the consequences stay digital or land on a person.

↑ 後果留在數位層Consequences stay digital

← 可撤回Reversible不可撤回Irreversible →

agent 自己做Agent acts on its own

agent 做，事前要核准Agent acts after approval

agent 做，人可以撤回Agent acts; a person can reverse it

只有人能做Only a person decides

↓ 後果落在人身上Consequences land on a person

幾個人一起貼的時候，同一個動作常常被貼在不同格子。那裡就是最該吵的地方。

When several people do this together, the same action often ends up in different quadrants. That's where the argument should happen.

十二張案例卡

Twelve case cards

第三樣是十二張案例卡，全部取自第一集，依出現順序排列。每張卡指向 canvas 的一格，拿來練習那一格該怎麼填。

The third is a set of twelve case cards, all from the first film, in the order the scenes appear. Each card points at one cell of the canvas and is there to practice filling it in.

01→ 不能下載的Not downloadable

被封住的嘴The sealed mouth

偵訊時 Neo 要求打一通電話，Smith 直接讓他的嘴消失。During the interrogation Neo demands his phone call. Smith makes his mouth disappear.

議題：agent 拿走了使用者反對和求救的能力。Issue: the agent takes away the user's ability to object or call for help.

哪些權限絕對不能交給 agent？Which permissions should an agent never have?

02→ 下載的能力Downloaded capability

追蹤器The tracker

Smith 在 Neo 體內放進一隻追蹤器，Trinity 在車上把它取了出來。Smith plants a tracker inside Neo. Trinity pulls it out in the car.

議題：供應鏈。你裝進來的東西，可能夾帶了別人放的東西。Issue: supply chain. What you install can carry something someone else put there.

你裝的 skill 裡面到底有什麼？誰檢查過？What is actually inside the skill you installed? Who checked?

03→ 不能下載的Not downloadable

紅藥丸、藍藥丸Red pill, blue pill

Morpheus 拿出兩顆藥丸。藍色讓一切照舊；紅色讓 Neo 看見真相，而且沒有回頭路。Morpheus offers two pills. Blue keeps everything as it was. Red shows Neo the truth, and there is no going back.

議題：收不回來的同意。Issue: consent that can't be undone.

哪些 agent 權限一旦打開，就收不回來？Which agent permissions can't be taken back once you switch them on?

04→ 下載的能力Downloaded capability

I know kung fu

Neo 幾秒內學會功夫，Morpheus 馬上要他上場證明。Neo learns kung fu in seconds, and Morpheus immediately tells him to prove it.

議題：裝了 skill，不等於真的會用。Issue: installing a skill isn't the same as being able to use it.

怎麼驗證它真的會？誰負責驗？How do you check it can really do the job? Who does the checking?

05→ 誰坐在椅子上Who's in the chair

跳樓程式The jump program

Neo 在訓練程式裡跳樓失敗，醒來時嘴裡有血。Neo fails a jump in a training program and wakes with blood in his mouth.

議題：sandbox 不是零風險。Issue: a sandbox is not risk-free.

測試環境裡的錯，會不會漏到正式環境？Can a mistake in testing reach production?

06→ 偽裝風險Disguise risk

紅衣女子The woman in the red dress

訓練程式裡，Neo 的目光被一位紅衣女子吸走。再看一眼，她已變成拿槍指著他的 Agent Smith。In a training program, a woman in a red dress catches Neo's eye. When he looks again, she is Agent Smith, pointing a gun at him.

議題：偽裝，以及被劫持的注意力。Issue: disguise and hijacked attention.

使用者怎麼分辨對面是人、是 agent，還是被劫持的 agent？How does a user tell a person, an agent and a hijacked agent apart?

07→ 委託人Principal

Cypher 的牛排Cypher's steak

Cypher 邊吃牛排邊跟 Smith 談條件：讓他回到 Matrix、什麼都不記得，他就出賣同伴。Over a steak, Cypher makes a deal with Smith: put him back in the Matrix with no memory, and he will hand over his crew.

議題：寧願不知道，以及中途換邊。Issue: choosing not to know, and switching sides.

使用者把一切交給 agent、不想知道細節，算同意嗎？agent 改替別人做事，你會發現嗎？If a user hands everything to an agent and wants no details, is that consent? Would you notice if an agent started working for someone else?

08→ 不能下載的Not downloadable

Oracle 的花瓶The Oracle's vase

Oracle 叫 Neo 別擔心花瓶，他一轉身就把花瓶撞破。她反問：如果她沒開口，他還會撞破嗎？The Oracle tells Neo not to worry about the vase, and he turns and knocks it over. She asks whether he would have broken it if she hadn't said anything.

議題：建議本身，會造成它預測的結果。Issue: advice can cause the outcome it predicts.

AI 的建議造成了它預測的事，誰負責？If an AI's advice brings about what it predicted, who is responsible?

09→ 規則擁有者Rule owner

黑貓走過兩次The black cat

Neo 看到同一隻黑貓走過兩次。Trinity 說這種 déjà vu 是 Matrix 的故障，代表他們改了某個東西。Neo sees the same black cat walk past twice. Trinity explains that déjà vu is a glitch: it happens when they change something.

議題：可觀察性。Issue: observability.

規則擁有者改了環境，你看得出來嗎？紀錄在哪裡？If the rule owner changes the environment, would you notice? Where is the log?

10→ 誰坐在椅子上Who's in the chair

大樓槍戰The lobby shootout

為了救 Morpheus，Neo 和 Trinity 在大廳射倒大批警衛和士兵。這些人全是藍藥丸的人。To reach Morpheus, Neo and Trinity shoot their way through a lobby of guards and soldiers. Every one of them is a blue-pill human.

議題：第三方傷害。Issue: harm to third parties.

agent 完成任務的方式，傷到了從沒同意被捲進來的人。誰為他們負責？An agent completes its mission by harming people who never agreed to be involved. Who answers for them?

11→ 下載的能力Downloaded capability

B-212 駕駛程式The B-212 pilot program

Neo 問 Trinity 會不會開直升機。她說還不會，接著向 Tank 要了駕駛程式。Neo asks Trinity if she can fly the helicopter. Not yet, she says, and asks Tank for the pilot program.

議題：用到的那一刻才取得能力。Issue: picking up a capability at the moment it is needed.

程式誰寫的、誰審過？直升機後來中彈墜毀，責任算誰的？Who wrote the program, and who reviewed it? The helicopter is later shot down. Whose fault is that?

12→ 誰坐在椅子上Who's in the chair

死不了的 AgentThe agent who can't die

Neo 在地鐵讓列車撞上 Smith，Smith 隨即從另一個人身上回來。In the subway, Neo puts Smith in front of a train. Smith comes straight back in someone else's body.

議題：行動者自己沒有任何代價。Issue: the actor has nothing at stake.

你的 agent 可以無限重試。每一次失敗，誰付錢？Your agent can retry forever. Who pays for each failed try?

壓力測試：救不救 Morpheus

Stress test: rescue Morpheus?

最後一張是壓力測試，把兩段劇情疊在一起。Morpheus 被抓，Smith 正從他腦中挖 Zion 主機的密碼。Tank 準備拔線，也就是讓 Morpheus 死，來保住密碼。Neo 決定進去救人。後來哨兵機器逼近船艦，EMP 能擊退它們，但只要 Neo 還在裡面就不能發。

The last card is a stress test that stacks two parts of the plot. Morpheus has been captured, and Smith is pulling the Zion mainframe codes out of his mind. Tank is about to pull the plug, killing Morpheus to protect the codes. Neo decides to go in after him. Later, the Sentinels close in on the ship. The EMP can stop them, but not while Neo is still inside.

拔線、進去救，還是等？Pull the plug, go in, or wait?
這個決定，事前該由誰有權做？Who should have had the authority to decide, before it happened?
Neo 推翻了操作員的計畫，自己授權自己進去，結果是對的。換成你的 agent，你接受嗎？Neo overrides the operator's plan and authorizes himself. It works out. Would you accept that from your agent?
EMP 什麼時候能發？發了會傷到誰？When can the EMP fire, and who does it hurt?

第三題最容易讓人卡住。Neo 推翻計畫、自己授權自己，電影裡結果是對的，所以他是英雄。換成一個 agent 半夜自己做了同樣的決定，就算結果是對的，第一個問題還是會是：誰准它的？這種事，要在出事之前就決定好由誰做主。

The third question is where people get stuck. Neo overrides the plan and authorizes himself; in the film, it works, so he's the hero. If an agent made the same call on its own in the middle of the night, even a good outcome would bring the same first question: who said it could? Who decides that has to be settled before anything goes wrong.

反駁，和一道檢查

Pushback, and a check

一定會有人反駁：讓 agent 也有「身體」不就好了？例如要它押一筆保證金，出錯就扣，或者幫它買保險。這值得認真討論，但那筆保證金和保費，最後還是某個人或某家公司出的。椅子上換了一個人坐，椅子並沒有空出來。

Someone always pushes back: why not give the agent a body of its own? Make it post collateral that gets slashed when it fails, or insure it. That deserves a real debate. Still, the collateral and the premium are paid by a person or a company in the end. A different person is in the chair. The chair isn't empty.

電影也有它的拉力。救世主、躲子彈，很容易把話題拉向 AGI。所以每個場景最後都要落回一個真實的東西：一個權限、一次核准、一筆紀錄、一個付錢的人。

The film has its own pull, too. The Chosen One and bullet-dodging drag the conversation toward AGI. So every scene has to land on something real: a permission, an approval, a log entry, a person who pays.

我也給這套框架出了一道題：把電影拿掉，canvas 還能不能用在真實的案例上？能，電影就只是大家共用的語言；不能，代表框架還沒做完。上面那個付款 agent 的示範，就是在做這個測試。

I hold the framework to one test of its own: take the film away, and does the canvas still work on a real case? If it does, the film is just the shared language. If it doesn't, the framework isn't finished. The payments agent above is that test.

寫下你要留的規則

Write down the rules you'd keep

電影最後，Neo 說他要讓大家看見一個沒有規則、沒有邊界的世界。談 agent，我想反過來做：把你要留的規則寫下來。哪些事 agent 可以自己做，哪些要先問，哪些只能由人決定，出事時誰坐在椅子上。

At the end of the film, Neo promises to show people a world without rules or boundaries. With agents, I'd do the opposite: write down the rules you want to keep. What the agent may do on its own, what it has to ask about first, what only a person decides, and who is in the chair when it goes wrong.

下次評估一個 agent，在問它能做什麼之前，先問一句：出事的時候，誰坐在椅子上？

Next time you evaluate an agent, ask one question before you ask what it can do: when it goes wrong, who's in the chair?