Choosing identity per session

Some agents shouldn't have their identity fixed in advance — the right answer depends on the task. For those, ask and dynamic put the choice to the person at the start of the session, before the agent touches anything.

codebot asks whose identity to use; a recommender suggests "Run as me", Jordan confirms, and the work runs under Jordan's account.

The choice

At session start, the agent pauses and asks whose identity to use. It's a real interaction card with three options — run as the agent, run as me, or cancel — and only the person who started the session can answer it.

The per-session identity choice: run as the agent, run as me, or cancel — with dynamic's advisory suggestion highlighted.
The per-session identity choice: run as the agent, run as me, or cancel — with dynamic's advisory suggestion highlighted.

ask vs. dynamic

  • ask presents the choice blank: two buttons, no lean.
  • dynamic adds an advisory recommendation. An isolated recommender LLM looks at what's being asked and suggests one option — here, because Jordan asked codebot to push to their fork, the recommendation is "Run as me," shown as a highlighted button with a short reason. The suggestion is only a suggestion; the person still confirms.

Notice how the recommendation is presented: the suggested action and the "Why" are shown as inert text, boxed off from the buttons. That's deliberate — the recommender's reasoning can reflect the conversation, which may be attacker-influenced, so it's never rendered as live markup that could smuggle in an instruction.

Nothing runs until you answer

Once you choose, the session resolves and the agent proceeds under that identity.
Once you choose, the session resolves and the agent proceeds under that identity.

Once Jordan chooses "Run as me," the session resolves to userPassthrough and codebot proceeds under Jordan's identity — the push and the PR are Jordan's. If the person cancels or the prompt times out, the session fails closed rather than silently defaulting to the agent's own account. A userPassthrough or ask/dynamic session always pauses on identity — it never guesses.