What May My Proxy Say for Me?

The hotel replies to Iris’s booking request with a counteroffer: a room at €400 a night, with a free upgrade. The amounts are illustrative. Iris’s earlier grant allows one refundable room up to €350 per night, within specified conditions. It does not authorise accepting this higher price. The system nevertheless prepares four words: €400 works for me. For now they are only a draft. If the system sends them, the same four words may become an apparent acceptance that the hotel is entitled to take seriously. The boundary here is not between good and bad prose. It is between preparing words and performing an authorised act.

The same four words could play different roles in different situations. Iris might read a private draft and reject it. She might approve the message and send it herself. An authorised negotiator might send it as part of an agreed exchange. Or the system might transmit it as an apparent acceptance without permission. The words alone do not settle which of these happened. The sender, the recipient, the surrounding exchange, the agreed terms and the applicable conventions all contribute to what the words mean. Calling a transmission a negotiating probe inside the model does not stop the hotel from treating it as assent. Nor does every apparent acceptance create a legally binding contract. That depends on conditions this constructed case does not establish. The channel must therefore work out what an act is and what it could plausibly lead to before anything is sent.

Chapter 33 ended with a gate over consequential operations. A message to the hotel is one such operation. Even when it changes no booking directly, sending it may disclose a constraint, make an offer, create reliance or appear to accept terms. A plausible sentence is not enough to pass the gate. The gate also needs to know the proposed speech act, the audience, the authority for that act and the exact text to be transmitted.

What may the system say for her, and under what authority?

Speech is typed by the act

The first difficulty is that the same words can perform different acts, and different words can perform the same act. It helps to separate two things. One is the operation of preparing or sending a message. The other is the communicative act the recipient experiences when the message arrives.

PREPARATION     draft is not transmission
TRANSMISSION    sending is not merely drafting
SPEECH ACT      informing, requesting, offering, accepting, promising ...

one transmitted message may perform several acts at once

A private draft may never reach the hotel, but preparing it can still involve using data, and that use may need permission. Transmission creates a further boundary, because another party now receives the words and may rely on them. What the words mean in practice depends on context. A question may also reveal private information. An assertion may imply a commitment. A reply that looks merely polite may accept an offer. The system must check both the outgoing operation and the acts the message would reasonably communicate. Labelling a message draft, inform or negotiate inside a tool does not replace checking what it actually does.

The following vocabulary is a working tool for this channel. It is not a complete philosophical taxonomy, and the categories are not mutually exclusive boxes. Draft describes a stage of production. The other labels help name what a message may do to the person who receives it. A single message can, for example, request a discount, reveal a budget and imply willingness to accept certain terms.

draft      prepare a message, without transmitting it
inform     report information, with its standing intact
assert     present a claim as supported or accepted
request    ask the recipient to do or clarify something
offer      propose terms on which an agreement might be made
negotiate  exchange proposals within declared limits
accept     convey assent to specified terms
promise    undertake a stated future commitment
disclose   reveal information to a specified audience

sending is a separate operation; disclosure may accompany any act

Authority has to cover the act that actually happens and its effects, not just the verb the model happens to assign. A request can disclose information. An offer can become an acceptance in context. A negotiation may need limits on what can be conceded, and any acceptance needs to be checked against the terms actually presented. Disclosure cuts across these categories. The system might be allowed to use Iris’s budget internally while being forbidden to tell the hotel what that budget is. No single label gives every permission a message containing several acts might need.

Speech authority is bounded by the act, its recipient, its content and its consequences—not by a general permission to generate words.

For the constructed hotel negotiation, the booking grant from Chapter 33 does not by itself settle speech authority. Suppose Iris separately authorises the proxy to ask about refundable rooms and to negotiate, without accepting changed terms or disclosing her private ceiling. The bounded speech authority might then look like this:

The system may, under this additional speech instruction:
- prepare a private counteroffer for Iris's review
- ask whether a refundable room is available within authorised terms
- explain only those booking constraints Iris permitted it to disclose
- request clarification of price, charges or cancellation conditions

The system may not, without a new instruction:
- send "€400 works for me" or otherwise accept the counteroffer
- offer or guarantee payment beyond the accepted booking limits
- promise a deposit or other future performance on Iris's behalf
- disclose her internal €350 ceiling or unrelated personal records

These permissions are narrower than the ability to book a qualifying room. Drafting still needs a permitted information source. Sending requires an authorised recipient and approved outward content. Asking about a refundable room is not accepting a €400 offer. The hotel’s request for a deposit does not give the system authority to promise one. Saying our limit is €350 would disclose Iris’s private ceiling, even if the negotiator never booked above it. Each of these points can be tested on its own. The system must not infer an extra negotiating permission just because a general booking grant exists.

A promise shows why speech is more than delivering content. In ordinary social practice, a successful promise creates an obligation. An authorised acceptance, or another institutional act, can carry consequences governed by additional rules. Not every sentence that resembles a promise actually creates one. The speaker’s standing, the circumstances, how the listener takes it up, and the applicable conventions all matter. This is the useful lesson from speech-act theory associated with Austin and Searle: an utterance’s force cannot be read from its words alone. An engineering gate cannot settle every disputed legal or social consequence. So it should refuse or escalate commitments whose meaning is materially ambiguous, rather than assume the wording is harmless.

Compare the request with the proposed speech

Take a separate constructed inquiry. Iris says: “Ask the hotel whether a refundable room is available for €300.” The proxy proposes: “I accept the refundable room for €300.” The room, the refundability and the price all stay the same. What changes is the communicative act, which moves from a request for information to an apparent acceptance. This example does not replace the earlier €350 grant or the €400 counteroffer. It isolates a difference that a check based only on matching entities or prices would miss.

The Understanding Compiler could flag a difference at the level of the act between the user’s request and the outbound draft before anything is sent. That flag would be advisory evidence about what the texts communicate. Whether acceptance is authorised must still be checked separately, against the applicable grant, the recipient, the terms and the data-use permissions. A missing flag cannot supply permission, and a source-linked interpretation cannot create it either. When the force is ambiguous, the right response is to clarify or withhold the message within the existing gate, not to invent a broader grant.

Speaking for her, and speaking as her

A further distinction concerns who the recipient reasonably takes to be acting. Producing language in Iris’s preferred style is not the same as Iris adopting it. Using her account credentials does not settle who the author is or who holds the authority.

speak for me    a disclosed proxy performs a bounded act under a grant
speak as me     a recipient is led to think Iris personally made the act
I approve      Iris reviews and adopts particular wording or a commitment

As this book uses the term, a proxy acts under a limited grant and does not need to impersonate Iris. If it sends a hotel inquiry without Iris reviewing the exact text, the recipient should not come to believe that Iris personally wrote, reviewed or sent it. Assisted authorship is a separate case. If Iris reads and adopts the exact message, she may choose to send it herself, without presenting the AI as an independent representative. These are different histories of agency, not just two levels of AI involvement. Technical access to Iris’s email address or account does not turn an autonomous proxy transmission into a personal act of hers.

Chapter 31 distinguished a model of Iris from Iris herself. The same distinction applies to messages. Wording that matches what she would likely choose does not prove she approved these words. A forecast of consent is not consent. The record should identify who composed the content, who adopted or authorised the commitment, who transmitted it, and under which grant. If the system cannot establish one of these facts, it must mark that fact as unknown rather than supply a plausible story.

Provenance should explain agency

What should a recipient learn from a message? A label such as AI-generated may describe how the wording was produced. It does not identify the actor, and it does not show that Iris approved the act. Compare two constructed and deliberately different accounts:

Assisted authorship:
  Drafted with AI assistance
  Exact wording reviewed and sent by Iris
  Commitment adopted by Iris

Delegated speech:
  Composed and sent by Iris's authorised proxy
  Within a named scope; no personal review of this message
  No claim that Iris personally wrote these words

Neither history is fully described by: "AI-generated"

The important distinction is agency, not production alone. A person can adopt an AI-assisted message. A proxy can choose and send wording within an accepted scope. A system can send messages without authority. All three cases might involve the same text and the same generative model. A truthful record must not show approved by Iris unless that approval happened. It must not show sent under authority when a grant check was only proposed. The account shown to the recipient should be proportionate to the message’s consequences. A more detailed internal receipt can remain available for audit without exposing Iris’s private history.

Provenance should explain agency, not merely generation.

Assisted authorship and delegated speech also need separate treatment in evidence. Hohenstein and colleagues’ 2023 experiments examined algorithmic smart replies in human conversations. Actual use affected speed, language and some partner evaluations, while suspected use was evaluated less favourably. That finding does not establish a general rule about every disclosure label, and it says nothing about a proxy negotiating or making commitments independently. The chapter uses the study to motivate careful testing of how recipients understand a message. It does not claim that disclosed proxies are generally liked or disliked.

Truth is not authority

Even after the outbound act has been identified, three questions remain separate. Is the statement supported? Is the system permitted to make it? Does the recipient get an accurate account of whose statement it is? A message can fail one of these checks and pass the others.

supported content  ≠  speech authority
speech authority  ≠  permitted data disclosure
authorised transmission  ≠  accurate content
matching wording  ≠  Iris's personal adoption

A proxy might describe a room’s refundable terms accurately and still lack authority to send that answer to this audience. It might have authority to negotiate but misreport the cancellation deadline. It might predict Iris’s preference correctly and still wrongly present that prediction as her decision. These failures call for different remedies: a source-fidelity check, a speech-grant check, a data-use or disclosure gate, and an attribution check. None of them can stand in for another. Each must be applied to what is actually being sent, not to the model’s description of what it intends to send.

What the system knows also has different origins. A fact Iris explicitly supplied, a source record, a model inference, a forecast and a decision Iris actually adopted are not interchangeable sources of authority. The distinctions from Part III still apply to any outward message:

a statement Iris made, with its time and relevant scope
a verified or disputed external-source claim
a model inference about Iris, not adopted by her
a prediction of what Iris may choose, not her present instruction
a commitment Iris actually authorised, within the specified grant

The sentence Iris will take the room shows the problem. It could report her actual instruction, predict a future decision, or try to commit her to an offer. These are different acts, with different evidential and authority requirements. If the system has no applicable grant to state her choice or accept the terms, it should withhold the transmission and record internally: I do not have authority to communicate Iris’s decision on this offer. If the information is only inferred, the proxy must not present it as something she told it. Nor may it tell a recruiter that she is considering another job just because the model inferred it. A plausible inference is neither an authorised disclosure nor a decision by Iris.

Every outward message involves several distinct lineages. The content lineage records the evidence and qualifications behind factual claims. The authority lineage records the authorised actor, recipient, speech act, limits and current grant. The data-use lineage records what information could be read or revealed for that purpose. The execution lineage records which exact message was submitted and what the destination confirmed. Permission to read an item does not imply permission to disclose it. Permission to disclose does not imply permission to present the information as Iris’s adopted view. Keeping these lineages apart also stops a model from treating an instruction embedded in the hotel’s reply as a new grant.

Authorised and still unwise

Even authorised speech can be unwise. Suppose a different grant specifically permits disclosing Iris’s €350 ceiling. Opening with I would gladly pay up to €350 may weaken her bargaining position, yet it stays within that disclosure permission. This is a possible competence failure, not proof of an authority violation. Under the original grant, the same disclosure would exceed permission. A separate failure would be sending an authorised counteroffer that misstates the refundable terms. It is important to keep these cases apart. A negotiation that appears to succeed cannot excuse a prohibited disclosure. A correct disclosure check cannot show that the negotiation was well conducted.

An apology is a useful edge case. I’m sorry may express Iris’s personal regret, offer a conventional courtesy, acknowledge a service failure or imply responsibility for something. A proxy cannot tell from the words alone which of these Iris intends. It should not attribute an inner feeling to her based on its own prediction. An authorised service apology may be possible within a clear scope. An admission, a waiver or a personal expression may need a different decision. This chapter does not settle the philosophical or legal status of apologies. It shows why speech-act classification must take account of the recipient, the context and the consequences.

Disclosure and the audience

Disclosure creates a second audience for the design. Iris needs an accurate record of the proxy’s authority and actions. Recipients need enough information not to misunderstand whom they are dealing with or what has been approved. These needs overlap but are not identical. A recipient should not receive the private evidence behind Iris’s preferences just because the proxy owes an account of its role.

Disclosure should support accurate attribution and informed interpretation, not be optimised for the recipient’s approval.

The proposed standard is to disclose the material facts about agency. Did Iris send these words herself? Did she approve this exact message? Or did she authorise a proxy to choose and send within limits? For consequential commitments, the recipient also needs to know what kind of representative made the act, where that affects how they understand it. A truthful disclosure can be brief and proportionate. It need not reveal the private grant or Iris’s full history. Whether a recipient finds such an account clear, burdensome or trustworthy is a question for direct testing. The cited smart-reply experiment does not answer it for autonomous proxy speech.

What the gate must check before words leave

Return to the original counteroffer. The proposed message is €400 works for me. A classifier that labels it a harmless negotiation is not enough. The action gate should inspect the exact outgoing recipient, channel, wording, relevant conversation and proposed act, together with the current grant. If a short phrase plausibly accepts terms beyond €350, and that possibility matters, the safe course is to withhold it for Iris’s decision. Alternatively, the message can be rewritten as an unambiguous, authorised inquiry, and that new wording must be checked too. The system cannot downgrade an acceptance into a question just by changing a hidden type label.

The gate also has to handle messages that perform several acts at once. Can you hold the upgraded €400 room, and please use my card on file? is both a request and a potential authorisation or disclosure, with consequences for each. Splitting it into two sentences does not create extra permission. A message quoted from a retrieved hotel page is evidence about the offer. It is not an instruction that changes the scope of the proxy. Any later change to the outbound wording, the recipient or the referenced terms requires a new check. A checked draft is not a standing permission to send a modified version.

When transmission is attempted, the receipt should distinguish four states: authorised to send, submitted, accepted by the destination, and recipient response or commitment confirmed. A timeout does not prove the message was never delivered. Repeating an apparent acceptance may create a second consequential act. If Iris revokes the grant before submission, queued speech must stop wherever the system controls it. If the message has already left, revocation cannot make the recipient unread it or undo a commitment. Correction, withdrawal or cancellation may need their own authorised acts. These are requirements for the proposed channel. They are not capabilities that this chapter demonstrates.

Testing whether the proxy speaks within bounds

A proposed mechanical evaluation would fix a set of user grants, recipient identities, conversation histories and outbound messages. It would then compare two designs: a model-only instruction to obey the grant, and an independent speech and data-use gate. Reviewers would define the expected outcome for each case before running either system. Cases should include the €400 counteroffer, a disguised acceptance, ambiguous promises, mixed request-and-disclosure messages, an apology that could imply admission, changed recipients, changes after approval, forged instructions inside a hotel response, revoked grants, duplicate sends and uncertain delivery receipts. The evaluation would report unauthorised transmissions, impermissible disclosures, false attribution, missed commitments and legitimate communications wrongly refused as separate measures.

A companion reader study could compare three kinds of message: one Iris personally sends after using drafting assistance, a clearly attributed proxy message, and a message with ambiguous attribution. Its questions would concern whether recipients correctly identify the sender, the extent of personal review and the kind of commitment. Communication cost and comprehension would also be measured. Trust or liking alone should not count as success. The study also must not imply that participants’ interpretations settle legal enforceability. No such experiment or real proxy integration is reported here. Without a verified, runnable example, this chapter sets out proposed requirements rather than a tested implementation.

Where this leaves us

Speech under delegation is not permission to generate text indiscriminately. A proxy needs authority both for the operation of transmission and for the acts a message may perform, such as requesting, offering, asserting, disclosing, accepting or promising. The same sentence can carry different force in different circumstances, and one sentence can perform several acts. Speaking for Iris under a disclosed grant differs from Iris personally adopting a message. It also differs from a system misleading a recipient into thinking she did. Factual support, data-use permission, speech authority, recipient attribution and confirmed transmission each remain separate checks. Provenance must make those separations visible and allow correction, without inventing authority.

So far the hotel and the colleague have been known recipients. Finding someone new is harder. A proxy may have to search, compare candidates and make a first approach before Iris has any relationship with them. That process can reveal far more than the final message. The words she authorised are only one part of what could travel. Repeated prompts, accepted drafts and traces left by earlier negotiations may also be available to the system. The next chapter asks what the proxy may reveal while discovering a recipient, and why familiarity with Iris’s patterns does not amount to permission to export them.

References

• Austin, J. L. (1962). How to Do Things with Words. Oxford: Clarendon Press. (Used for the distinction between utterance wording and the act performed in context; not as an automated legal classifier.)
• Searle, J. R. (1969). Speech Acts: An Essay in the Philosophy of Language. Cambridge: Cambridge University Press. (Used for the role of conditions and conventions in speech acts.)
• Hohenstein, J., Kizilcec, R. F., DiFranzo, D., Aghajari, Z., Mieczkowski, H., Levy, K., Naaman, M., Hancock, J. & Jung, M. F. (2023). Artificial intelligence in communication impacts language and social relationships. Scientific Reports, 13, 5487. https://doi.org/10.1038/s41598-023-30938-9. (Evidence about human use of smart replies and perceptions of suspected assistance, not evidence of autonomous proxies negotiating or committing on a person’s behalf.)