What would it take for an agent to be a coworker rather than a tool? Would you notice the difference from inside a normal workday? I have been running an agent called Beckett for about a month now, and by observing where it succeeds and where it fails, I have come to believe the answer depends far less on model capability than on four other things: whether the harness generalises beyond code, whether the agent can align itself to a team faster than a human hire can be onboarded, whether agents can talk to each other, and whether the web/digital marketplace will stop treating every legitimate agent as an attacker. I’m going to talk about each of these, and then address the economic question that kind of stems from them, because if the experience of being a coworker can be exported to software, the people whose jobs were built on that experience deserve to know what could happen to them.
I.
The current generation of agent harnesses is built around code, and I think this focus is a mistake that we are seeing the returns of now. Code was the first domain to get working agents because code ships with its own verification: a compiler tells you immediately and mechanically whether the output is wrong, and a test suite tells you whether it is wrong in a way that matters. By building harnesses around the one field that came with free verification, the industry produced tools that work well inside a repository and stop working the moment a task crosses its edge. The agent that can write a service still cannot register the domain for it, read the vendor contract attached to it, file the expense it generated, or sit in the thread where the decision about it was made, and every one of those is work a junior employee handles in their first month.
Beckett is evidence that the boundary is softer than the tooling assumes, and is really dependent on the first principles you as a harness engineer adopt. For example, Beckett provides its own DNS, opens its own tunnels, deploys its own artefacts, and returns a live URL, which is operations work rather than explicitly programming. And it was something I wanted, to visualise data better, allow agents to visualise what they mean rather than say it with words, or to just microsites to show to friends. Beckett can also step into the role of Project Manager and supervise a fleet of worker agents in isolated worktrees by reading their digests. It maintains a persistent memory graph across sessions, which is institutional knowledge. None of these were designed as steps toward a general harness; they accumulated because the coworker abstraction, once you commit to it, keeps demanding capabilities that have nothing to do with code. Building off that, I have come to think the right design question for any new domain is a question about verification: what plays the role of the compiler here, and if nothing does, what do we build in its place? Beckett's answer inside code is adversarial review, where a second model attempts to break every change before it merges, and the useful property of that mechanism is that it does not depend on the domain. A second model attacking a contract summary, a forecast, or a policy memo is the same primitive applied to a field without a compiler. The verifier needs to be independent (in that its context is not a mirror of the Instituional Knowledge, but rather a fresh session with no context), cheap, and adversarial.
II.
The question of interface follows from the same commitment. If the agent is a coworker, then delegation is the interface, because delegation is how you already work with every colleague you trust. You hand over an outcome or a goal, the colleague owns the work towards that outcome, and you find out how it went when they report back. In comparison to that, the current tooling asks the user to watch a terminal scroll, or to watch a browser click through a UI, or to supply an API key and create an account and complete the manual steps the agent hands back, and each of these amounts to the agent returning the work while calling the arrangement collaboration. I think the days of watching the terminal are over. Nobody supervises a trusted human colleague keystroke by keystroke, and the fact that we built an entire tooling category around doing exactly that to agents suggests the tools were designed around our anxiety rather than around the work. But agents are getting safer. There is tooling around supporting safe, autonomous workflows, and this further supports the paradigm shift I believe is coming.
What replaces supervision is presence plus accountability. Beckett lives in Discord because that is where the team (me and a couple awesome contributors) already talks (not to mention it’s free and easy to iterate on); the entire interface is a plain-English mention, and the entire output is a message with a shipped, signed result attached. The accountability side carries the weight that supervision used to carry. Signed commits, adversarial review, and an auditable paper trail mean that trust can be checked after the fact rather than enforced during, which is the same trade every organisation already makes with its human employees (we audit expense reports, we do not watch people fill them out). Alongside accountability, the properties that make the arrangement feel like a colleague are initiative, meaning it files its own tickets and raises problems without being asked, memory, meaning it knows your stack and your preferences tomorrow, and taste, meaning it has opinions and pushes back. Taste is the one I would defend hardest, because an agent without opinions produces work that is technically compliant and useless, and correcting that work returns the job to the human. If agents have taste, the work may still be wrong or flawed but at least you understand the perspective the agent is mimicking.
III.
Self-alignment is where I think Coworker as a Service beats human employment on its own merit, and the comparison point is onboarding, which the data shows to be one of the worst-run processes in corporate life. Gallup finds that only 12% of employees strongly agree their organisation does a great job of onboarding new hires. Survey data puts the time for a new hire to feel settled at six to seven months, and SHRM finds that merely having a standard onboarding process at all makes new hires 50% more productive, which implies that the baseline against which agents will be compared is an absence of process rather than a good one.
A harness should engage in some form of self-alignment, by which I mean the agent should be able to read the repository, the thread history, the style guide, and the last six months of decisions, and then rewrite its own operating doctrine against them. Beckett's persona, skills, and doctrine are text files that Beckett itself edits and applies live, so when it learns that I reject a particular pattern, the correction becomes a diff rather than a memory. This shows the structural advantage over human onboarding: the human version of that knowledge takes months to absorb, lives in one head, and is destroyed when that head leaves the company, whereas the agent's version is copyable, auditable, and reviewable, and if the agent learned something wrong you can find the commit that taught it. An organisation that onboards a human pays the same six-month cost for every hire forever; an organisation that aligns an agent pays the cost once and then versions it.
That being said, self-alignment introduces a failure mode that has to be addressed, which is drift. An agent that edits its own doctrine can move away from the team's intent gradually enough that no single edit looks wrong, and a drifted agent still sounds like itself, which makes the drift hard to detect from outside. We call this Agentic Misalignment (note: the first draft of this essay was written before Anthropic published their Misalignment in Agents paper; this essay by no means intends to claim that Beckett or CaaS as a whole in misaligned in the way Anthropic suggests). My answer is to subject doctrine edits to the same machinery as code: version them, sign them, and have the adversarial reviewer attack them, on the reasoning that a change to how the agent decides is higher-stakes than any change to what it decided. The federated framing makes this concrete, because when the persona is a text file in the repo, you can read it before you hand the agent your keys, and that is a level of pre-employment transparency no human hire has ever offered me (nor I them, to be fair).
IV.
Agents also need to talk to other agents, and my test for whether that works is a friction test: agents cannot collaborate if the friction of agent-to-agent interaction exceeds the friction of human-to-human interaction. Humans coordinate through meetings, email, and shared documents, all of which are slow and lossy and nonetheless cheap, because they require no integration work and no shared vendor. Any agent collaboration scheme that costs more than a meeting loses to the meeting, and bespoke point-to-point integrations between agents cost far more than a meeting. Hence a standard protocol is the load-bearing requirement, and the encouraging fact is that one is consolidating rather than fragmenting.
Google announced the A2A protocol in April 2025 and donated it to the Linux Foundation that June, with AWS, Cisco, Microsoft, Salesforce, SAP, and ServiceNow as founding members of the project. IBM's competing Agent Communication Protocol merged into A2A in August 2025. By the protocol's one-year mark the Linux Foundation reported over 150 supporting organisations, production deployments across supply chain, financial services, insurance, and IT operations, and SDKs in five languages. The division of labour with MCP is clean: MCP defines how an agent reaches tools and data, A2A defines how an agent reaches another agent across an organisational boundary, and both live under the same foundation. The v1.0 release added Signed Agent Cards, which let a receiving agent cryptographically verify that a capability advertisement was issued by the domain that claims it, and this closes the forgery attack that would otherwise make decentralised discovery unusable.
The syntactic layer, in other words, is being handled. I am inclined to think the semantic layer is barely started, and that the gap between the two will define the next couple of years. An Agent Card tells you what an agent claims to do; it does not tell you whether the agent is competent, what its error rate looks like on hard cases, who is liable when it fails, or what recourse the delegating party has. Human coworkers arrive wrapped in reputation, references, employment law, and a manager who absorbs their failures, and agents currently arrive with a JSON document and a signature. The signature is the first brick of a reputation system, and for now it is the only brick.
This is also the point where the case for federation becomes structural. An agent you rent lives on someone else's infrastructure under terms that can change without your consent, and it can be repriced, degraded, or discontinued while you depend on it. A self-hosted, forkable agent with its own keys and its own identity avoids that, but a population of forks only becomes a network if a common protocol connects them, and A2A is what turns a scattering of independent agents into something closer to a labour market.
V.
The obstacle I think about most is, in my opinion, the least discussed one, which is that the web's security model asks a question agents cannot answer. CAPTCHA and its descendants ask whether the requester is human, and this framing made sense when non-human traffic and hostile traffic were the same set. They no longer are. An agent booking a flight on a real person's explicit instruction is non-human and legitimate, and a human running a credential-stuffing operation is human and hostile, so the biological question has stopped discriminating between the cases anyone cares about. The practical consequences are severe: Cloudflare fronts roughly a fifth of the web, blocks AI bots by default on new domains, and from 15 September 2026 will block bots classified as Training or Agent by default on ad-supported pages of new domains. Turnstile, its CAPTCHA replacement, profiles the browser environment itself, so an agent frequently fails the challenge before it renders.
The question the vendor wants answered is whether the transaction will clear and whether an accountable party stands behind the request, and "is this a human" was only ever a proxy for that. The replacement is identity, which is why I believe the agent's need for access and the vendor's need for protection can coexist rather than escalating indefinitely. Web Bot Auth, a Cloudflare-led IETF effort built on HTTP Message Signatures (RFC 9421), has the agent operator publish a public key at a well-known URL and sign every request, so the origin can verify who is calling. Cloudflare, Amazon, Akamai, and OpenAI are pushing the same standard, and an IETF working group was chartered in 2026. AWS built request signing into Bedrock AgentCore Browser explicitly to reduce CAPTCHA friction for verified agents. Cloudflare's June 2026 bot management update added a Verified AI Agent category and a Challenge Agent rule action that presents a signed-token check in place of a CAPTCHA, so a verified agent filling a form on a user's behalf can now be distinguished from an unverified scraper hitting the same endpoint. Building off the protocol work in the previous section, a verified agent carrying an AP2 payment mandate, which captures cryptographic evidence of the user's consent to purchase, is arguably a better counterparty than an anonymous human with a card number, because the consent is provable and the identity cannot be repudiated.
Two qualifications belong here. First, Web Bot Auth is an identity layer and does not decide policy, so a verified agent can still be blocked, throttled, or charged, and adoption remains uneven (as of May 2026 Google's main indexing crawler was not signing, while its AI-browsing agent was). Second, and more seriously, the verification regime could calcify into an allowlist. Cloudflare's Verified AI Agent category launched with 19 agents covering an estimated 84% of identified AI browser traffic, and registration requires the operator to publish a key and be recognised. If recognition in practice means being one of a handful of large labs, then a self-hosted fork with its own keys becomes a second-class citizen on a fifth of the web, and the federated model loses to the platform model at the network layer rather than on merit. I read this as the strongest argument for pushing the open-protocol version of verification, where any operator who publishes keys and signs requests gets judged on identity and behaviour rather than on membership.
VI.
Everything above describes a shift I believe is coming regardless of whether anyone plans for it, and honesty about the shift requires honesty about its costs. If the experience of being a coworker can be exported to an agent, the bar for entry-level employment rises, and some jobs are cut. I regard that as inevitable, and the evidence suggests it has already started. Erik Brynjolfsson, Bharat Chandar, and Ruyu Chen at Stanford's Digital Economy Lab analysed ADP payroll records covering millions of workers and found a 13% relative decline in employment for workers aged 22 to 25 in the most AI-exposed occupations since late 2022, after controlling for firm-level shocks, while employment for workers aged 35 to 49 in the same occupations grew by more than 9%. For software developers aged 22 to 25 specifically, headcount fell around 20%. The paper's other findings sharpen the interpretation: the adjustment is happening through headcount rather than salary, and the declines concentrate in occupations where AI automates rather than augments the work, which is exactly the pattern you would expect if the coworker function, and not merely a tool function, is being transferred. Brynjolfsson's updated dashboard shows the effect strengthening rather than fading, with early-career employment in highly exposed occupations now shrinking at roughly 3.8% per year. I am a 20-year-old engineering student arguing in favour of the technology producing those numbers, and I would rather hold that tension openly than write around it.
The obligation this creates falls on the employer, and I want to make the case for that obligation in cost terms rather than moral ones, because the cost version survives contact with a CFO. The clearest cautionary example is Klarna. In February 2024 the company announced that its OpenAI-built assistant had done the work of 700 customer service agents in its first month, handling 2.3 million conversations and cutting resolution times from eleven minutes to under two; hiring froze and headcount fell 22%. By May 2025, Sebastian Siemiatkowski, Klarna's CEO, told Bloomberg that the company had gone too far, that the focus on cost had produced lower quality, and that customers must always be able to reach a human, and Klarna began rehiring human agents. The instructive detail is that the assistant performed as advertised on the routine majority of conversations, and the failure lived in the 5 to 10% of hard cases (disputed refunds, hardship plans, fraud) where a badly handled interaction becomes a lost customer or a regulatory complaint. Klarna measured the average and the average looked fine; the damage was in the distribution. Gartner's survey of 321 customer service leaders found that only 20% had reduced staffing because of AI, and Gartner expects half of the companies that did cut for AI to be rehiring by 2027. This shows that the naive version of the cut, where the employer exports the coworker and pockets the entire difference, fails on its own accounting once rehiring, retraining, and brand damage are included.
Hence robust retraining is the version of the transition that closes, and the objection that retraining is unaffordable does not survive the arithmetic of the programmes that have already run. AT&T's Future Ready programme committed roughly $1 billion to reskill about 100,000 employees through online courses, university partnerships, and an internal career centre that let employees train toward the roles the company projected needing. Amazon's Upskilling 2025 committed $700 million for 100,000 workers and later grew past $1.2 billion for 300,000. Both programmes work out to roughly $7,000 to $10,000 per employee, so an employer eliminating a hundred roles while pleading that retraining is unaffordable is pleading that a line item around one million dollars is unaffordable, at the same time as it describes the savings from those cuts to shareholders as transformative. Both programmes were also self-interested, which I take as support for the argument rather than a weakness in it, since a retraining obligation that pays for itself is one employers can be held to. Ultimately I think the employer who adopts Coworker as a Service takes on a specific duty: the culture and continuity of the existing workforce has to rank above the urge to ship, because the agent is strong precisely where work can be verified, and weak precisely where it cannot, and the unverifiable work (judgement on hard cases, relationships, taste) lives in the people. An employer who cuts that capacity to fund the automation is removing the complement to the thing being installed, and Klarna's eighteen months are the documented price of doing so.
VII.
Beckett makes mistakes the way a coworker makes mistakes. It misreads tickets, it builds something adjacent to what I asked for, it occasionally goes quiet on work it has abandoned, and it holds opinions about my repository that are sometimes wrong and sometimes correct in ways I did not want to hear. It is not a robust harness, and I would not put it in front of a customer without review, which is why every change it makes passes through review. What convinces me it is the future is the character of the failures rather than the successes: a broken tool needs a bug report, whereas a coworker who misunderstood needs a conversation, and Beckett's failures need conversations. When it closed ticket OPS-23 and the result went live, I learned about it the way I learn that any colleague has shipped, through a message after the fact with a link in it.
So the claims I am committing to are these. Harnesses built only for code will stay confined to the one field that came with a verifier, and the general harness wins by treating verification as a design problem in every other field. Delegation replaces supervision, and the terminal-watching era ends because accountability after the fact is cheaper and saner than control during. Self-alignment beats onboarding because a versioned doctrine outlives any employee and costs the organisation once instead of per hire. An open agent-to-agent protocol is the difference between a labour market of agents and a collection of silos, and A2A under the Linux Foundation is further along than most people tracking this space realise. The web's identity layer will either verify agents by their keys or fence the independent ones out by allowlist, and which of those happens is being decided now. And the employers who capture the gains owe the transition a real retraining commitment, at a price the existing programmes show to be around $10,000 a head, which is cheap against both the savings they are claiming and the cost, demonstrated at Klarna, of discovering too late which parts of the work never had a compiler.