Ask an organisation that deployed AI agents and decided how they behave, and you'll usually find a name by working backwards through a repository. Somebody wrote the system prompt. Somebody granted the tool permissions. Somebody decided what the agent does when it is unsure. That person wasn't appointed to the role, wasn't trained for it, and has no view of what happens when a few hundred agents built from similar templates start talking to each other.
They are a choice architect. Thaler and Sunstein gave us the term for whoever arranges the context in which a decision gets made: which option is the default, which are suggested, what is made salient, what order things come in. A system prompt that says "when uncertain, stop and ask" is a default. A tool manifest that lists one search provider before another is an ordering effect. A retrieval setup that surfaces some documents and not others is information highlighting. These are not metaphors. They are the interventions nudge theory has studied for two decades, applied by the organisation to its own agents, by someone who has never heard the phrase.
More nudgeable than we are, and living in a crowd
Two findings from the last year make this matter more than it did. The first is that agents built on large language models turn out to be far more sensitive to choice architecture than people are. A team at MIT took a decision task from human behavioural research and ran leading models through it under defaults, suggestions and highlighted information. The models swung further than the human baseline, in helpful and harmful directions alike, and asking them to reason step by step did not steady them. A follow-up on agents that navigate web interfaces found the same thing across every model and provider tested. The authors call it a neglected safety concern: agents can be brittle under small changes to their choice environment even when nobody is attacking them.
The second is that agents in groups behave like groups. Replications of Asch's conformity experiments with language model agents find that they fall in with a majority, more so when uncertain and more so the longer the interaction runs. Populations of agents left to interact develop shared conventions nobody programmed, and a committed minority of adversarial agents can overturn the convention of the whole population once it reaches a critical size. The researchers who found that last result noted it could be exploited by injection attacks on norm formation. So the thing being nudged is hypersensitive, and it conforms.
Put those together, and the organisation's own defaults end up in competition. A well-written system prompt is a nudge that has to hold against every nudge the agent meets downstream: the dark pattern on a checkout page, the instruction buried in a retrieved document, the message from another agent that has already been turned. I argued in the Brace work that nudge and boost are not enough for cybersecurity because the choice architect is often hostile and people need to be braced for contact rather than steered. That was about people. It now applies to agents, which are easier to steer than people were.
Three roles you already have, for a population you have not given them
If agents are nudge-sensitive individuals in a social system, the roles that govern human social systems have counterparts here. Three matter.
The choice architect sets the environment. For people, that is whoever designs the policy, the login screen, the phishing report button and the defaults. For agents, it is whoever writes the prompt, grants the tools, sets the retrieval scope and decides what happens on uncertainty. The role exists in every organisation that has deployed an agent. It has simply not been named.
The broker sits inside a team and connects it to a function elsewhere. Burt's work on structural holes showed that people who bridge otherwise separate groups carry disproportionate influence and information. Security champions are brokers by design: a developer who also speaks for security inside her own team, and speaks for her team back to the security function. My doctoral work asks whether a champion's position in the informal network, measured by betweenness, predicts her influence on colleagues' behaviour. For agents, the broker is the person embedded in the team that owns a set of them, who knows what those agents are for and can read their behaviour in context. Telemetry is only useful to someone who can interpret it against intent, and that knowledge lives in the team, not at the centre.
The intervener handles contact when behaviour has already gone wrong. Somebody has to decide whether an agent that has started to drift gets watched more closely, throttled, quarantined or stopped, and at machine speed that decision will usually be pre-authorised rather than made live. The intervener owns those pre-authorisations for the agents in her area and takes the call when they run out.
In a human security programme, the same champion often holds all three. The question is whether that should be true for agents too, and where those people should sit.
Why the current answers leave the seat empty
The field has three main responses to agentic risk, and each assumes the human who shapes agent behaviour rather than designing for them.
Human-in-the-loop approval keeps a person in the chain for consequential actions. Its problem is arithmetic. Agents act at machine speed in numbers that will outrun the humans available to approve them, and a recent analysis argues that the more autonomy an agent is given, the less its user can oversee it, so, in the current state of the art, oversight degrades the overseer. That is Bainbridge's irony of automation, forty years on and at scale.
Governance frameworks and regulation name the need. The EU AI Act requires deployers to assign oversight to natural persons with the competence, training and authority to carry it out. ISO 42001 and the NIST AI RMF ask for documented roles. These requirements are right, but none says what competence, where the person sits, or how a dispersed set of people forms a structure rather than a list.
Guardian agents answer the arithmetic by adding agents. Gartner expects AI that watches other AI to take a tenth or more of the agentic market by 2030, and I expect it to be deployed and to be necessary. But a guardian is itself an agent, subject to the same conformity and nudge sensitivity as the agents it watches, configured by the same undesignated architect. Watching the watchers widens the loop rather than escaping it. What a human broker in the team adds is the one thing no guardian has: knowledge of what these agents were meant to do, here, for this process.
Give your champions the agents
Most large organisations already run a Security Champions Network. The proposal is to extend it, not replace it: an agent champion is a member of a team that owns or operates agents, not a member of the security function, and she holds the roles for the agents in her own team.
She authors or reviews the prompts, tool grants and norm statements for her team's agents against a central baseline, and she is the named natural person the regulation asks for. She reads the behavioural signals for her agents in the light of what they are for, feeds observations to the centre and carries changes back. She owns the pre-authorised responses for her agents and is the first call when those aren't enough. What she does not do is approve individual agent actions, which is the saturating model this replaces.
Placement is the heart of it. If position in the informal network predicts influence for human champions, the analogue for agents is to put champions where agents from different teams interact: at the boundary between an orchestrating agent and the agents it calls, at the shared tools and memory through which agents influence one another, at the hand-offs between business processes. A champion inside one isolated team sees her own agents. A champion at a boundary sees the contagion crossing from one team's agents to another's, which is where the collective dynamics live.
Norms flow the way policy should have flowed for people all along. The centre publishes a versioned baseline. Champions extend it locally. Both are served to agents from a repository rather than baked into prompts, so a change propagates without redeployment and an agent that has not pulled the current version is visible as such. Each agent attests on a schedule which norm version it holds; each champion confirms on a longer schedule that the local norms are still fit; the centre sees both.
This should work because it already does for people, and the mechanisms are the same. Champions networks spread behaviour through the informal network, catch local drift faster than central audit, and fail in known ways: when champions are chosen by seniority rather than position, when the centre treats them as a broadcast channel rather than a sensor, and when nothing they observe can change anything. The agent version will fail in the same ways if it is built the same way.
Whats next
The mapping from human networks to agent collectives is an analogy until it is tested, and it is testable with the apparatus the conformity studies already use: populations of open-weight agents on a communication graph, repeated rounds, one variable moved. If a committed minority cannot capture a population holding an organisational norm, the threat is smaller than I think. If a braced norm holds no better than a bare default against a hostile instruction in the material, the content of the norm does not matter, and only its presence does. If a reinforcing node at the highest-betweenness position in the graph does no better than one at the edge, then where a champion sits does not matter for agents even if it matters for people, and the design above loses its central principle. I am running those experiments now and will publish when it's complete.
In the meantime, the practical question stands. Somebody in your organisation is the choice architect for your agents. Do you know who, and have you told them?