Muse beat ChatGPT's first twelve days on iOS; this week Meta moved its agent onto glasses, into an inbox of its own, and behind a checkout Amazon has blocked

The constraint that decides where an agent can live

What a face costs in milliseconds

The platform that says no

Where the research locates the failure

Where your product sits

• You sell through a storefront or a checkout. Amazon has already answered the question of whether an agent may buy from it. Write your own answer into the terms, rather than discovering it in a support queue, and settle it this quarter.
• You are building the agent that acts elsewhere. The grant of permission is the product surface that matters. Put the decision in a component the model cannot rewrite or talk its way past, keep credentials out of its context, and log every action against the exact scope granted.
• Your safety case rests on a benchmark. Rerun it with the hazard words swapped for neutral ones. If the score drops, you measured vocabulary recognition. Do that before your next review, because two weeks of incident reporting have taught reviewers to ask.
• You are weighing hardware for an ambient agent. A camera and a microphone that are always on move the design problem to the trust boundary and the storage key. Read Meta's five requirements as the bar a security review will hold you to, and price the audit work into the plan.

A pilot in six weeks

1. Put a number in the hypothesis. "One delegated write action, run end to end by the agent, completes at or above the rate our users manage today, and asks for human approval on fewer than 20% of attempts."
2. Choose one reversible action. Bookings you can cancel, drafts you can discard, carts you can empty. Pick a connector that separates read scope from write scope, and grant read first.
3. Put the permission outside the agent. A model asked to police itself is the thing PASTABench measures, and the best of 16 models timed its own interventions correctly 40.74% of the time 10. Route every action through a decision the agent cannot edit.
4. Count four things. Actions attempted, approvals requested, granted scope against requested scope, and blocks at the point where data would leave. A rising approval rate is the early warning.
5. Test the storefront, not only the agent. Run your own catalogue through the agent with a vague goal and a priced step, and watch whether it reads the spec sheet or the badge 9.
6. Fix the gate before you read the results, and keep the rollback to one configuration change.

The serving figures, the preference study and the safety architecture come from Meta's own engineering and research write-ups: the glasses architecture from 23 September, and the Muse safety design from the agent's launch on 8 September. The adoption numbers are third-party estimates from Apptopia and Appfigures, which cannot see Meta's internal figures, and Meta has published none of its own. The connector-application count is Meta's, given on stage. Amazon's block is reported by CNBC with the company's statement, and Meta declined to comment. The two research findings come from preprints whose authors ran their own experiments: eight deployed models from three providers in the shopping study, 16 models in PASTABench.