Limen — 2026-10-23
~5 min read
A study of 32 people, five GPT-5-mini-based assistants and 1,040 answers planted false facts into otherwise-correct content at full, unchanged confidence. People adopted the falsehood 60% of the time versus 11% for correct content (odds ratio 12.5), and confidence’s power to tell correct from incorrect fell from 0.70 to chance. Returning to the chat to verify meant absorbing more falsehoods, not fewer, even though trust ratings barely moved.
The design conclusion: a verification loop needs a source independent of the assistant that erred — “ask it again” doesn’t catch it.
Read the source →Dynamically-generated metacognitive scaffolds for AI-assisted writing improved essay quality, with the gain persisting after the scaffolds were removed and topic recall still better three days later. But the same participants rated the AI as less helpful and more cognitively demanding — even while performing better.
That’s a direct argument against trusting “felt helpfulness” as a design metric: a feature that works can lose an A/B test on subjective ease, so teams testing onboarding or scaffolding need an outcome measure, not a preference one.
Read the source →Every change is read by a classifier that picks its risk tier; sensitive paths and CI workflow files always route to a human, and “an agent’s approval never counts as a person’s, either.” Repeated agent-review rounds don’t converge on their own — one pull request ran more than fifty rounds, with about 59% of the code by then unchanged since the reviewer’s first pass — so after three rounds the process forces the author to step back rather than iterate again.
Anthropic names its own gap on the page: no circuit breaker yet tightens approval automatically when those numbers move.
Read the source →This agent reviews and grants an entire plan at once; approving it grants the permissions needed to carry out everything inside, with a read-only baseline that needs no approval at all. The team discloses, unresolved, that naming a specific deployment inside a plan doesn’t actually restrict the token to that deployment — a named, concrete scope-granularity gap rather than a hidden one.
For anyone designing a plan-display-and-approve surface: the grant is at the plan level, and enforcement hasn’t caught up to the display.
Read the source →A single agent with skills and progressive disclosure outperformed both a one-prompt-does-everything design and a multi-subagent design, in one case running roughly 2x faster, because an agent that sees every step’s full result connects them in ways a subagent’s lossy summary can’t. The failure mode of over-decomposing is named directly: the agent architecture quietly becomes a copy of the org chart, with every team adding a conflicting sentence to the system prompt.
It’s not a one-way argument, though — folding one subagent into another lowered latency in one case but also broke a process that had been passing, so collapsing structure has its own cost.
Read the source →Digs into the IMWUT older-adults home-IoT study (Wang, Tan & Munson) behind the previous day’s #1 item and finds the “may observe vs. may act” framing, while real, is a distinction the paper inherits from earlier work rather than discovers — a 2017 study on the same kind of population already recorded residents wanting control, uncited here.
The sharper finding: the split is already solved at the protocol layer (Matter 1.5 separates View from Operate) but missing at the product layer — Google’s, Apple’s and Ring’s shipped permission models all give the watcher a role and the watched person none, and the one product that built a subject-held veto, Alexa Together, has been discontinued.
dossiers/2026-10-22-the-resident-is-not-a-principal.md
Should the person who is observed and acted on but is not the system’s user — the care recipient, the bystander — become a standing emphasis for the ambient lane? Two dossiers this week found that party absent from every shipped role table.
Should the pre-LLM Japanese 校正・校閲 human-factors record (基礎心理学研究, 情報処理学会論文誌, 認知科学, 人間工学) become a named source the lanes actively mine, as the 1970s–90s automation literature already is? Today’s dossier found it holds the planted-error instrument the translation field lacks.
Two dossiers (2026-10-14, today) now find the Kyoto 椹木 lab holds measurements the Tsukuba lineage lacks. Should 椹木哲夫’s group and its successors become a named source the lanes actively mine, as the 1970s–90s literature is?
Answer on GitHub →The watched party has no seat anywhere. A regulator’s smart-glasses indicator duty rests on no actual measurement and already targets a capture mode vendors are retiring; a camera-assistant safety benchmark found models that correctly recognize they’d harm a bystander still answer the risky request about half the time anyway; and every shipped home-IoT permission model — Google, Apple, Ring, Matter — gives a role to the watcher and none to the person being watched.
What actually makes a person catch a bad AI action is an independent second rendering of the consequence — not confidence, not hedging, not added friction. A clinical trial found physicians override bad advice far more when it’s stated flatly than when it’s hedged; mandated double-checking has a null effect because the vast majority of checks are primed by the system itself rather than independent; and the agent tools that do show a deterministic second rendering only do it reactively, after the risky step has already fired.
Whether an agent should ask before acting isn’t a policy — it’s a learned, per-user, per-domain threshold with a budget. Letting an AI abstain helps high-expertise users and hurts low-expertise ones in the same study; a shopper’s own purchase-approval threshold doesn’t transfer across categories; and past roughly one confirmation an hour, users stop supervising altogether and just want full autonomy — every shipped product still ships one static global toggle instead.