{
  "video": {
    "id": "V2UqEUA8NjM",
    "title": "Stop Making Your Customers Click Approve - Emil Chetty, Wise",
    "duration": 933,
    "upload_date": null,
    "channel": "AI Engineer",
    "source": "AI Engineer",
    "event_format": ""
  },
  "analysis": {
    "video_id": "V2UqEUA8NjM",
    "title": "Stop Making Your Customers Click Approve - Emil Chetty, Wise",
    "one_liner": "Get the customer to agree to the job rather than every step: turn their intent into an immutable, versioned agreement, let the agent choose the steps, and have deterministic downstream services enforce the agreement, so a fooled model still can't pay a new recipient.",
    "summary": "Emil Chetty, who leads data and AI product at Wise, argues that step-by-step approval turns the promised assistant into a queue of requests and makes the human the API. Coding-agent controls such as auto mode, classifiers and sandboxes ask whether an action looks safe, but a regulated payment must answer whether this customer authorized this payment to this recipient on these terms, which evals and harnesses alone can't establish. He walks through a hypothetical in which a small business owner, Sarah, confirms an immutable job that scopes the agent's access and is checked by Wise's existing services. Plans can change freely inside the agreement, while changed terms need a revised proposal and a new customer decision.",
    "key_points": [
      "Wise's constraints don't disappear behind a chatbot: it holds 80+ licenses, and regulators still expect it to know what a customer authorized, control what happens to their money and explain the outcome.",
      "Coding-agent controls and payment authorization answer different questions: 'Does this action look safe?' versus 'Did this customer authorize this payment to this recipient on these terms?' Evals and harnesses are still needed but can't show the customer agreed to the job.",
      "The flow runs from intent to immutable agreement: an agent explores with limited read-only access, trusted software resolves suppliers, bank details and amounts from records, and missing or conflicting details are resolved before the job is made immutable.",
      "The job has two views: a promise in human language for the customer (in the example, three suppliers, $775 plus fees, and which decisions are delegated versus looped back) and a machine-readable promise that services verify against. Confirming and authenticating records the decision against that exact version.",
      "A trusted provisioning platform deterministically checks the confirmed job, what Wise permits the agent to do and the customer's current rights, then provisions limited access from their intersection to an execution agent that splits into a payment worker and a reconciliation worker.",
      "Two loops separate plan from agreement: the agent can re-plan inside the agreement, but different terms, such as a changed or expired quote, require a revised proposal that the agent can prepare but cannot approve itself.",
      "Immutable jobs and shared payment state give resilience: after a restarted Kubernetes pod or a crashed app, services can look up what has already executed, so the worker follows the existing payment rather than creating a second one.",
      "Under prompt injection, even if the agent believes payment details were updated, the new payee fails at the service check because the agent can't rewrite its own agreement; the boundary relies on downstream services, not the model spotting the scam. The sketched architecture includes gateways for provisioning and job verification, controlled routes to LLM providers, and an agent gateway where tools are registered and evidenced."
    ],
    "takeaways": [
      "When introducing an approval flow or a new agent, have the customer agree to the job and delegate it, instead of approving each step.",
      "Enforce the agreement in deterministic services at execution time, and never authorize an action because the model said it was what the customer wanted.",
      "Show the customer a human-readable job with explicit bounds, pair it with a machine-readable version, and record their authenticated decision against that exact immutable version.",
      "Provision agent access from the intersection of the confirmed job, what the platform permits the agent to do and the user's current rights, starting preparation with limited read-only access.",
      "Let agents re-plan freely within the agreed terms, but route any change to those terms back to the customer as a revised proposal the agent can't approve itself."
    ],
    "topics": [
      "agents",
      "agent-autonomy",
      "authorization",
      "payments",
      "fintech",
      "prompt-injection",
      "human-in-the-loop",
      "compliance"
    ],
    "tools": [
      "Wise",
      "Wise Business",
      "Wise Platform",
      "Anthropic auto mode",
      "ChatGPT",
      "Hermes",
      "MCP",
      "Confluence",
      "Kubernetes"
    ],
    "quotes": [
      {
        "text": "We ultimately made the human the API.",
        "at": "05:02",
        "url": "https://www.youtube.com/watch?v=V2UqEUA8NjM&t=302s"
      },
      {
        "text": "But a payment needs a different kind of answer to a different kind of question.",
        "at": "05:29",
        "url": "https://www.youtube.com/watch?v=V2UqEUA8NjM&t=329s"
      },
      {
        "text": "What you approve is ultimately what we enforce.",
        "at": "10:18",
        "url": "https://www.youtube.com/watch?v=V2UqEUA8NjM&t=618s"
      },
      {
        "text": "So the boundary doesn't actually depend on the model spotting the scam.",
        "at": "13:52",
        "url": "https://www.youtube.com/watch?v=V2UqEUA8NjM&t=832s"
      }
    ],
    "words": 2920
  },
  "summary_url": "/#V2UqEUA8NjM",
  "transcript": {
    "html": "/transcripts/V2UqEUA8NjM.html",
    "txt": "/transcripts/V2UqEUA8NjM.txt",
    "vtt": "/transcripts/V2UqEUA8NjM.vtt"
  }
}