An AI runs the therapy session. A clinician watches from the background and steps in if something looks risky.

The selling point is an operations claim: one clinician can now cover far more patients.

That's Limbic's Unpacked, running 20-minute sessions with Medicare patients over the phone under an FDA pilot. Careful work, not a stunt: a licensed Medicare provider, more than a hundred pages of documentation, nine clinical studies behind it.

But a supervision ratio is an operations question, and nothing in the clinical file answers it. How many sessions per clinician? What triggers an alert? Who covers alerts at night? What happens to the sessions where the clinician overrides the AI?

Most firms are not deploying therapy. Plenty of them now have an agent doing real work with real access, and the same questions apply.

Your staff went through onboarding. Their own login. Access that fits the job. A manager who sees the work. A review on a schedule. Access shut off on the last day. In a regulated firm, most of that is required and well documented. The FTC's rule for tax preparation firms says to determine who has access to customer information and to reconsider regularly whether they still have a business need for it.

The agent got none of that.

And the fix is not to train the agent. That is where the comparison flips. For a person, training is the main control and access limits are the backstop, because a person carries judgment into situations no policy anticipated. An agent does not. Instructions to an agent work more like suggestions.

So for an agent, access is the control: its own identity rather than an employee's login, the narrowest access that does the task, no credentials sitting where it can find them, approval before anything irreversible, and a log a named person actually reads.

Start with the biggest one people hand over without thinking: an agent that can read the email account has every client attachment anyone ever sent you or that you sent them.

The training still matters. It moves. The new mistake at the keyboard is not handing a password to a phisher. It is handing access to your own agent: pasting a key into a chat, connecting a whole drive when one folder would do.

So, five questions. Who owns the agent? What can it reach? Who reads what it did? When does its access get reviewed? What would end it?

If an agent has been working at your company for six months and nobody can answer those, it was never onboarded. It just appeared and started doing the work.