---
title: "Agent Trust Patterns"
author: Dan Birman
url: https://dbirman.com/patterns
updated: 2026-11-09
summary: "Six interface patterns for AI agents that act for someone: booking a flight, paying an invoice, emailing a restaurant."
---

# Agent Trust Patterns

Six patterns · v1 · Oct 2026 · Updated Nov 2026

Six interface patterns for AI agents that act for someone: booking a flight, paying an invoice, emailing a restaurant. They’re for the people who design and build those agents and decide when one should stop and ask, and what it should show.

Each pattern starts from a documented problem, proposes an interface I haven’t seen shipped, credits the closest prior work, and has a demo you can try. Victor Yocco’s six patterns, which follow the lifecycle of an agentic interaction from Intent Preview to Escalation Pathway, are the closest published set to these that I know of ([Smashing Magazine](https://www.smashingmagazine.com/2026/02/designing-agentic-ai-practical-ux-patterns/)).

## How to use them

Start with the demos. They use made-up data, and Drift, Shelf and Record have a switch to try them with and without the pattern. Consent also has a live version that takes your own instruction. In a design review, check any flow where an agent acts for someone against the four rules under “The pattern,” and read “Watch for” to see how each one can go wrong. If you’re building one, [Build it](https://dbirman.com/patterns#build-it) maps each pattern to today’s protocols and names the gap. Once a month I score a real agent product against all six. [Review No. 1](https://dbirman.com/review-chatgpt-work) is ChatGPT Work.

## The six

[01 Consent by example](https://dbirman.com/consent) Don’t make people read the rules they’re granting. Show them the edge cases and let them sort.

[02 Interrupt on drift, not on danger](https://dbirman.com/drift) The agreed plan is the baseline. Interrupt when the agent leaves it, not every time it does something risky.

[03 Questions with a shelf life](https://dbirman.com/shelf) Ask early, say what you’ll assume, and stop asking once the answer can’t help.

[04 Whose idea was this?](https://dbirman.com/whose) Before an irreversible step, mark any part of the reasoning that came from someone other than you.

[05 Show the track record](https://dbirman.com/record) Before you delegate, see how often “done” was actually done for this kind of task.

[06 The other side of the agent](https://dbirman.com/other) Design for the person on the receiving end of an agent’s email, booking, or purchase.

## Build it

Each pattern can build on a piece of today’s agent protocols and specs, and each one shows a gap in them. The links go to the versions current on November 9, 2026: [MCP (spec 2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation), [AG-UI 1.0](https://docs.ag-ui.com/spec/1.0/basic/patterns/interrupt-resume), [OpenAI’s Model Spec (October 29, 2026)](https://model-spec.openai.com/2026-10-29.html#scope_of_autonomy) and [AP2 (v0.2)](https://ap2-protocol.org).

| Pattern | Build on | The gap |
| --- | --- | --- |
| [01 Consent](https://dbirman.com/consent) | An [MCP elicitation](https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation) form to show the edge cases and collect your answers. A [Model Spec scope](https://model-spec.openai.com/2026-10-29.html#scope_of_autonomy) to hold the result: a semi-structured record, with fields like `max_cost` and `tool_constraints`, that the platform can validate, enforce and audit. | A scope holds rules once someone has written them. This pattern is about writing them: the agent picks the cases it’s least sure about, and each disagreement becomes a written rule. |
| [02 Drift](https://dbirman.com/drift) | The [Model Spec’s scope of autonomy](https://model-spec.openai.com/2026-10-29.html#scope_of_autonomy). When a task can’t be completed within the scope, the model should notify the user and seek approval. | The Spec’s example scope record has fields for tools, time and cost, plus a free-text `additional_details`. The approved plan has no field of its own, so a step can stay inside every limit and still leave the plan. |
| [03 Shelf life](https://dbirman.com/shelf) | An [AG-UI interrupt](https://docs.ag-ui.com/spec/1.0/basic/patterns/interrupt-resume) can carry an optional `expiresAt`. Once the consumer judges it expired, it can no longer be answered, only abandoned. | In this pattern, expiry follows progress, not the clock, and an expired question takes its stated default instead of being abandoned. [MCP elicitation](https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation) has no expiry field. [The spec](https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/mrtr) says servers should put a short expiry inside `requestState` to prevent replay, and clients must not read that string, so the interface has nothing to show when a question lapses. |
| [04 Whose idea](https://dbirman.com/whose) | For payments, [AP2’s signed checkout mandates](https://ap2-protocol.org) tie an approval to a specific, finalized checkout. | [MCP](https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation) makes clients show which server is asking, but not which input led the agent there. A request has a mode, a message, and a form schema or URL. None of them is for where a step came from, which leaves the free-text message. |
| [05 Track record](https://dbirman.com/record) | The [Model Spec](https://model-spec.openai.com/2026-10-29.html#scope_of_autonomy) says scopes should be recorded in a semi-structured format so the platform can validate, enforce and audit them. | A scope records what the agent may do. This pattern also needs a record of how it went: how often “done” held up for this kind of task, measured from what happened, not from the agent’s report. |
| [06 Other side](https://dbirman.com/other) | [MCP](https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation) requires clients to show which server is asking, with clear decline and cancel options. That’s the disclosure this pattern asks for, but made to the person who sent the agent. | Neither MCP nor [AG-UI](https://docs.ag-ui.com/spec/1.0/basic/patterns/interrupt-resume) has a field that names who should answer, so neither can address a question to the person on the receiving end. MCP servers must bind each request to the client and user identity, and an AG-UI interrupt’s message is a prompt “for whoever answers.” |

The [AG-UI 1.1 working draft](https://docs.ag-ui.com/spec/draft/basic/patterns/interrupt-resume), which no SDK implements yet, keeps the same expiry rule and still has no field that names who should answer.

Each demo is plain HTML and JS in its page’s source. A package comes later.

## How to cite

Cite as: Dan Birman, Agent Trust Patterns, dbirman.com/patterns, 2026. For a single pattern, add its number and version from the top of its page.

## Changelog

- Nov 2026This page and its Build it map. A switch on the Drift, Shelf and Record demos to try them with and without the pattern, and every outside claim checked against its source.
- Oct 2026v1: six patterns, each with a demo.