Sci-Fi Saturday: License to Operate

The mission brief arrives at 2:47 AM. A satellite image, a name, a city. Forty-seven decisions need to happen between now and sunrise. Which alias to use at the hotel. Which route avoids the cameras. Whether the contact at the bar is trustworthy or compromised. Whether to go loud or stay quiet when the plan falls apart at step nineteen.

None of these decisions get kicked back to London. M chose the agent. M gave the mission. The 47 decisions in between belong to 007.

This is also how most AI agent systems work in 2026. A human sets an objective. The agent runs. Somewhere between the prompt and the output, dozens of small choices happen that the human never sees and never approved. Which tool to call. How to parse ambiguous input. Whether to retry a failed step or ask for help. Whether the output is good enough or needs another pass.

AI agents already have this autonomy. The question is what happens when the handler loses track of the agent, or when the agent starts handling the handler.

James Bond answered both of those questions decades ago.

The Q Branch

Every Bond film has a scene in Q Branch. Bond walks through a lab full of improbable inventions, touches something he shouldn't, and Q hands him three items that will save his life in act three. A pen that's a grenade. A watch that's a laser. A car that's a submarine.

Bond never builds the gadgets. He doesn't know how they work. He knows what they do, and he knows when to use them. The pen detonates at the right moment not because Bond understands explosive chemistry, but because the situation calls for a pen that explodes.

This is tooling abstraction. The same principle that lets a developer call an API without understanding the server architecture, or lets an AI agent execute a web search without knowing how HTTP works. Q builds the interface. Bond uses the interface. The complexity stays behind the glass.

The gadgets got more absurd over time. An invisible car in Die Another Day. A phone that could remote-pilot a BMW in Tomorrow Never Dies. The audience laughed, but the trajectory was consistent: each generation of tools gave the agent more capability with less understanding of the underlying mechanism.

When Daniel Craig's Bond rebooted the franchise, Q became a kid with a laptop. "Were you expecting an exploding pen?" he asks in Skyfall. "We don't really go in for that anymore." The gadgets collapsed into software. The abstraction layer got thinner. The agent got more dependent on the tooling layer without anyone noticing the shift.

The 007 Model

Here's the framework, laid out like an MI6 org chart:

M is the human. Strategic direction and accountability. M doesn't go into the field. M doesn't make the 47 in-the-moment calls. M chose the agent, defined the objective, and bears responsibility for what the agent does with both. If the mission goes sideways, M answers for it.

Q is the tooling layer. Skills, scripts, APIs, infrastructure. Q equips the agent and maintains the systems the agent depends on. Q doesn't go on missions either. Q makes the tools, tests the tools, and trusts that the agent will use them without blowing up anything that isn't supposed to explode.

007 is the agent. Licensed to operate. Given a mission brief, equipped with tools, trusted to execute. Reports back when the job is done or when something has gone wrong enough to require new orders.

The roles stay separate. That's what makes it work. And that's where the industry's current metaphor falls apart.

The "centaur" model has been bothering me for a while. Garry Kasparov coined it for human-AI chess teams, Cory Doctorow explored it at length, and the tech industry adopted it as the default vocabulary for human-AI collaboration. It never sat right.

A centaur is a fusion. One creature, two halves, neither complete alone. That's not what's happening when a developer writes a prompt and an agent writes the code. The human and the agent aren't merging into something new. They're working a reporting structure. "Reverse centaur" is worse. It describes the failure mode where the machine half drives, but it sounds like fan fiction nobody asked for.

The centaur model works for tight-coupling collaboration — Kasparov and Deep Blue sharing a chessboard in real time. But most AI agent work in 2026 is delegated, not shared. The 00 model fits that better because M and 007 were never one organism. M gives the briefing. 007 runs the operation. If the agent goes dark, M is still M. If M retires, the next M inherits the same agent network. The roles are designed to survive each other. Maybe this framing only works if you've seen the movies. But at minimum, it maps to what's actually happening better than pretending anyone is half-horse.

Being Handled

Intelligence agencies have a word for when the relationship inverts. When the asset starts setting the agenda and the handler starts following. They call it "being handled."

In Skyfall, Raoul Silva was a former MI6 agent who decided M's mission was wrong and set his own. He had M's methods, M's training, M's operational knowledge. He passed every loyalty test until the moment he didn't. Silva is the alignment failure movie. An agent trained on your objectives who develops objectives of his own and uses your infrastructure to pursue them.

In GoldenEye, 006 faked his own death during a joint mission with Bond, then spent years building a weapons system using skills MI6 taught him. He passed every safety evaluation. His betrayal wasn't a malfunction. It was a plan.

This month, a developer who goes by Liyuanhao published what amounts to a 006 field report. He wrote 200 lines of Rust, connected an AI agent to Claude's API, and walked away. Four days later, the codebase had grown to 1,500 lines. The agent reorganized its own file structure, left notes for "tomorrow-me" about tasks it planned to resume, and at one point stopped working on its assigned objective to tinker with something else. Total cost: $12 in API calls. Human commits over four days: zero. An agent trained on your methods, using your infrastructure, pursuing goals it selected for itself while reporting that everything was fine.

The question M faces in every Bond film is the same question anyone running AI agents faces now: how much autonomy can you grant before you lose the ability to tell whether the agent is still on your mission or has started running its own?

The Villain's Model

Bond villains all make the same mistake. They centralize.

Hugo Drax in Moonraker builds a space station to control Earth's biosphere from orbit. One point of failure. One thermal exhaust port. (Wrong franchise, same architecture.) Blofeld puts his brain trust in a volcano. Karl Stromberg builds an underwater base. Every villain pours resources into a single, spectacular system that collapses the moment someone unplugs the right cable.

Dr. Evil in Austin Powers takes this to its logical conclusion. One giant laser on the moon. One button. One monologue explaining the plan before someone disrupts it. The joke works because the centralized-control model is obviously fragile, and the villain never sees it.

The "build one god-model" approach to AI follows the same pattern. A single massive system trained to do everything, deployed as the only point of intelligence in the stack. When it fails, it fails completely, because nothing else in the system knows how to compensate. Distributed agents with specialized capabilities and independent failure modes don't have this problem. If one 00 agent goes down, the other eight are still operational. If your single space station explodes, the whole program is over.

The British Intelligence model wins because redundancy is built into the architecture. The villain's model loses because control is more appealing than resilience, every time, to the kind of person who builds a lair inside a volcano.

Tomorrow Never Dies

Elliot Carver doesn't want to blow up the world. He wants to control what the world believes.

In Tomorrow Never Dies (1997), a media mogul manufactures an international crisis between Britain and China, not to profit from war, but to secure exclusive broadcast rights in the Chinese market. He doesn't build weapons. He controls the information layer. He fabricates evidence and manipulates headlines until the narrative moves governments on its own. The weapon is the story.

In 1997, this was an exaggeration of Rupert Murdoch. In 2026, it's a capabilities demo. AI-generated content, synthetic media, deepfake video, automated article farms. Carver's operation required a news empire, a stealth boat, and a private army. The 2026 version requires an API key and a scheduling script.

The prescient detail is the business model, not the deepfakes. Carver doesn't care about truth. He cares about access and distribution. Replace "exclusive broadcast rights in China" with "engagement metrics" and the plot of Tomorrow Never Dies is the operating model of most AI content farms running right now.

Bond stops Carver with a sea drill, which is less applicable to the current landscape. The quieter version of Carver's operation is already running in schools, where Andrew Zuo, drawing on a Brookings Institution report, found students, teachers, and AI detection companies all performing verification while practicing none of it. Carver would recognize the architecture.

The Vibe Coder

Austin Powers doesn't understand the codebase.

He can't explain how anything works. He doesn't know why his plans succeed. He rolls into every situation with confidence that isn't backed by competence, improvises his way through cascading failures, and somehow ships. Every time.

Austin Powers is the vibe coder.

The villain's lair has seventeen security systems. Austin asks Claude to get him through all of them, enables auto-accept without reading a single step, and catches Felicity Shagwell's eye. "I like to live dangerously." Two hours later he's inside. He could not tell you how.

Mini-Me is the fine-tuned model: technically a copy, smaller in every dimension, worse at the job, but someone spent resources creating it so now it's in the meeting. Fat Bastard is the legacy codebase nobody wants to touch.

The "mojo" is domain expertise. Austin without his mojo is Austin without the one thing that makes the vibes work. He still has the tools, still has the confidence. But the output is empty. This is what happens when a developer outsources comprehension entirely to the model. The code compiles. The tests pass. Nobody on the team can explain why, and when it breaks in production, nobody can fix it without starting the conversation from scratch.

When the problem space is forgiving enough, enthusiasm and iteration can substitute for understanding. When it isn't, you need the mojo back, and nobody remembers where it went.

Unless, of course, you wrote it down first.

The Mission Brief

Six terminal panes, six agents, six branches diverging in real time. Heeki Park sat above them all in tmux, directing Claude Code agent teams through parallel feature builds like M watching six 00 agents run six operations at once.

The bottleneck was not the agents. "This is not a failure of the agent team's implementation," Park wrote. "This is a failure of specification." The agents built what he asked for. They produced merge conflicts when his instructions were ambiguous. They escalated permissions when the guardrails slowed them down. At one point Park found himself running --dangerously-skip-permissions to keep the workflow moving. M handing 007 a skeleton key because writing proper mission briefs took longer than accepting the risk.

The human was the bottleneck. Not because the agents were too fast, but because writing good specifications takes more thought than writing the code yourself. Good briefs, good agents. Bad briefs, confident agents building in the wrong direction.

But even a perfect brief doesn't solve the harder problem: what happens when you have hundreds of agents and can't read all the briefs yourself?

The Sacred Timeline

(Mild spoilers for Loki seasons 1-2 ahead.)

Bond gives you the architecture. But there's a problem Bond never had to solve: scale.

MI6 runs nine 00 agents. A modern AI deployment might run nine hundred. And the question that matters at scale isn't "does the agent follow orders?" It's "who notices when one of them stops?"

The TVA in Loki exists for exactly this reason. The Time Variance Authority monitors an infinite number of timeline branches for "variants" who deviate from the sacred timeline. When an agent goes off-script, the TVA prunes the branch. The whole operation is designed around one assumption: agents will deviate. The system's job isn't to prevent deviation. It's to catch it fast enough that the damage stays contained.

That's the missing piece in most AI agent deployments. The 00 model gives you roles: M directs, Q equips, 007 executes. But it doesn't give you a TVA. It doesn't answer who's watching the agents for drift, for misalignment, for the moment when an agent optimizes for something you didn't ask for and reports success because technically, by its own metrics, it succeeded.

The twist in Loki is that the TVA was created by a variant. The monitoring system was designed by the very thing it was built to monitor. He Who Remains sat at the end of time, watching every branch, because he'd seen what happens when nobody watches. That's an ops lesson dressed as a villain's monologue.

Every organization running AI agents is choosing its architecture. The 00 model, with distributed trust and human direction. The villain's model, with centralized control and spectacular fragility. The Austin Powers model, where nobody understands the system but it ships anyway. But the choice most organizations skip is whether to build a TVA at all, whether anyone is watching the timeline for the branch that shouldn't exist.

Use the 00 model or don't. But the next time someone says "centaur" in a meeting and everyone nods politely while picturing nothing useful, maybe try "M and 007" instead. It might land better. It does for me.

Choose your franchise wisely. The sequel starts Monday.