# What May My Proxy Say for Me?
# Book: Language
# Chapter URL: https://programmer.ie/books/language/33-chapter/
# Prose fingerprint (sha256, normalized): 1ce186f2513f80a022a31be8bbe59246a9d11dd8bdf3ee8ea5eeed6dddb5cdda
# Snapshot generated at build time by Hugo. This is the complete rendered prose
# of the chapter; it is not a transcript of the source file.

The hotel replies to Iris’s booking request with a counteroffer: a room at €400 a night, with a free upgrade. The amounts are illustrative. Iris’s earlier grant permits one refundable room up to €350 per night within specified conditions; it does not authorise accepting this higher price. The system nevertheless prepares four words: €400 works for me. For the moment they are only a draft. If the system sends them, the same four words may become an apparent acceptance that the hotel is entitled to take seriously. The boundary is not between good and bad prose. It is between preparing words and performing an authorised act.
The four words can appear in several settings. Iris might read a private draft and reject it. She might personally approve and send an acceptance. An authorised negotiator might send a message as part of an agreed exchange. Or the system might transmit an apparent acceptance without permission. The words alone do not settle what happened: the sender, recipient, surrounding exchange, agreed terms and applicable conventions contribute to their force. Calling a transmission a negotiating probe inside the model does not stop the hotel from treating it as assent. Nor does every apparent acceptance necessarily create a legally binding contract; that depends on conditions this constructed case does not establish. The channel must account for the act and its plausible consequences before sending.
Chapter 32 ended with a gate over consequential operations. A message to the hotel is one such operation. Even when it changes no booking directly, sending it may disclose a constraint, make an offer, create reliance or appear to accept terms. The gate therefore needs more than a plausible sentence: it needs the proposed speech act, its audience, the authority for it and the actual text to be transmitted.
What may the system say for her, and under what authority?
Speech is typed by the act The first difficulty is that the same words may be used to perform different acts, while different words may perform the same act. There are also two dimensions that should not be collapsed: the operation of preparing or transmitting a message, and the communicative act performed when someone receives it.
PREPARATION draft is not transmission TRANSMISSION sending is not merely drafting SPEECH ACT informing, requesting, offering, accepting, promising ... one transmitted message may perform several acts at once A private draft may never reach the hotel, but preparing it can still involve data use that requires permission. Transmission creates a further boundary because another party now receives words and may rely on them. Their practical meaning depends on context: a question may also reveal private information, an assertion may imply a commitment, and a response that looks merely courteous may accept an offer. The system must check both the outbound operation and the acts the message would reasonably communicate. Calling the message draft, inform or negotiate inside a tool is not a substitute for checking its effect.
The following is a working vocabulary for the channel, not a complete philosophical taxonomy or a set of mutually exclusive boxes. Draft describes a production stage. The other labels help name what the message may do to its recipient. A message can, for example, request a discount while revealing a budget and implying willingness to accept certain terms.
draft prepare a message, without transmitting it inform report information, with its standing intact assert present a claim as supported or accepted request ask the recipient to do or clarify something offer propose terms on which an agreement might be made negotiate exchange proposals within declared limits accept convey assent to specified terms promise undertake a stated future commitment disclose reveal information to a specified audience sending is a separate operation; disclosure may accompany any act Authority must cover the actual act and its effect, not merely the verb assigned by the model. A request can disclose information. An offer can become an acceptance in context. A negotiation may need limits on what can be conceded, while any acceptance needs checks against the terms actually presented. Disclosure is cross-cutting: the system may be allowed to use Iris’s budget internally but not tell the hotel what that budget is. No one label supplies every permission needed by a message containing several acts.
Speech authority is bounded by the act, its recipient, its content and its consequences—not by a general permission to generate words.
For the constructed hotel negotiation, the booking grant from Chapter 32 does not by itself settle speech authority. Suppose Iris separately authorises the proxy to ask about refundable rooms and negotiate without accepting changed terms or disclosing her private ceiling. The bounded speech authority might then look like this:
The system may, under this additional speech instruction: - prepare a private counteroffer for Iris's review - ask whether a refundable room is available within authorised terms - explain only those booking constraints Iris permitted it to disclose - request clarification of price, charges or cancellation conditions The system may not, without a new instruction: - send "€400 works for me" or otherwise accept the counteroffer - offer or guarantee payment beyond the accepted booking limits - promise a deposit or other future performance on Iris's behalf - disclose her internal €350 ceiling or unrelated personal records These permissions remain narrower than the ability to book a qualifying room. Drafting still needs a permitted information source; sending requires an authorised recipient and outward content. Asking about a refundable room is not acceptance of a €400 offer. The hotel’s request for a deposit does not create authority to promise one. And saying our limit is €350 would disclose Iris’s private ceiling even if the negotiator never booked above it. Each of these is independently testable. The system must not infer an extra negotiating permission from the fact that a general booking grant exists.
A promise shows why speech is more than content delivery. In ordinary social practice, a successful promise undertakes an obligation; an authorised acceptance or other institutional act can have consequences governed by additional rules. Not every sentence that resembles a promise successfully creates one. Speaker standing, circumstances, uptake and applicable conventions matter. This is the useful lesson from speech-act theory associated with Austin and Searle: the force of an utterance cannot be read from its words alone. An engineering gate cannot decide every disputed legal or social consequence, so it must refuse or escalate materially ambiguous commitments instead of guessing that the wording is harmless.
Conceptual guide to the chapter; no new empirical result is asserted. Open full-size diagram. Speaking for her, and speaking as her A further distinction concerns who the recipient reasonably understands to be acting. Producing language in Iris’s preferred style is not the same as Iris adopting it, and using her account credentials does not settle the question of authorship or authority.
speak for me a disclosed proxy performs a bounded act under a grant speak as me a recipient is led to think Iris personally made the act I approve Iris reviews and adopts particular wording or a commitment A proxy, as this book uses the term, acts under a limited grant and does not need to impersonate Iris. If it sends a hotel inquiry without her reviewing the precise text, the recipient should not be led to believe that Iris personally composed, reviewed or sent it. But assisted authorship also matters: if Iris reads and adopts the exact message, she may choose to send it herself without presenting the AI as an independent representative. These are different agency histories, not merely two degrees of AI involvement. Technical access to Iris’s email address or an account does not transform autonomous proxy transmission into her personal act.
Chapter 30 distinguished a model of Iris from Iris herself. The same distinction applies to messages: wording that matches her likely choice does not prove she approved these words, and a forecast of consent is not consent. The record should identify who composed the content, who adopted or authorised the commitment, who transmitted it and under which grant. Where the system cannot establish one of these facts, it must mark it unknown rather than supply a plausible story.
Provenance should explain agency What should the recipient learn from a message? A label such as AI-generated may describe how wording was produced, but it does not identify the actor or establish that Iris approved the act. Compare two constructed and deliberately different accounts:
Assisted authorship: Drafted with AI assistance Exact wording reviewed and sent by Iris Commitment adopted by Iris Delegated speech: Composed and sent by Iris's authorised proxy Within a named scope; no personal review of this message No claim that Iris personally wrote these words Neither history is fully described by: "AI-generated" The important distinction is agency, not merely production. A person can adopt an AI-assisted message; a proxy can choose and transmit wording within an accepted scope; and a system can transmit without authority. The same text and the same generative model might be present in all three. A truthful record must not display approved by Iris unless that approval happened, or sent under authority when a grant check was merely proposed. The recipient-facing account should be proportionate to the message’s consequence, while a more detailed internal receipt can remain available for audit without exporting Iris’s private history.
Provenance should explain agency, not merely generation.
Assisted authorship and proxy speech need separate treatment in evidence as well. Hohenstein and colleagues’ 2023 experiments examined algorithmic smart replies in human conversations: actual use affected speed, language and some partner evaluations, while suspected use was evaluated less favourably. That finding does not establish a rule about every disclosure label, still less a result about a proxy independently negotiating or making commitments. The chapter uses the study to motivate careful evaluation of recipients’ understanding, not to claim that disclosed proxies are liked or disliked in general.
Truth is not authority There are separate questions even after an outbound act has been identified: is the statement supported, is the system permitted to make it, and does the recipient receive an accurate account of whose statement it is? The same message can fail one check while passing the others.
supported content ≠ speech authority speech authority ≠ permitted data disclosure authorised transmission ≠ accurate content matching wording ≠ Iris's personal adoption A proxy may truthfully describe a room’s refundable terms and still lack authority to send the answer to this audience. It may have authority to negotiate but incorrectly report the cancellation deadline. It may accurately predict Iris’s preference yet falsely attribute that prediction to her as a decision. The remedies differ: a source-fidelity check, a speech-grant check, a data-use or disclosure gate, and an attribution check do not substitute for one another. Each must be applied to what is actually being sent, not just the model’s description of its intention.
What the system knows also has different origins. A fact Iris explicitly supplied, a source record, a model inference, a forecast and a decision Iris actually adopted are not interchangeable sources of authority. The distinctions from Part III still govern any outward message:
a statement Iris made, with its time and relevant scope a verified or disputed external-source claim a model inference about Iris, not adopted by her a prediction of what Iris may choose, not her present instruction a commitment Iris actually authorised, within the specified grant The sentence Iris will take the room illustrates the problem. It could report her actual instruction, predict her future decision or attempt to commit her to an offer. Those are different acts with different evidential and authority requirements. If the system has no applicable grant to state her choice or accept the terms, it should withhold the transmission and say internally: I do not have authority to communicate Iris’s decision on this offer. If the information is merely inferred, the proxy must not represent it as something she told it. Nor may it tell a recruiter that she is considering another job merely because the model inferred it. A plausible inference is neither an authorised disclosure nor a decision by Iris.
Every outward message needs several distinct lineages. The content lineage identifies the evidence and qualifications supporting factual claims. The authority lineage identifies the authorised actor, recipient, speech act, limits and current grant. The data-use lineage identifies what information could be read or revealed for that purpose. Finally, the execution lineage identifies which exact message was submitted and what the destination confirmed. An internal permission to read an item does not imply permission to disclose it; authorisation to disclose does not imply authorisation to attribute the information to Iris as her adopted view. The separation also prevents a model from treating an instruction embedded in the hotel’s reply as a new grant.
Authorised and still unwise Even authorised speech can be unwise. Suppose a different grant specifically permits disclosing Iris’s €350 ceiling. Opening with I would gladly pay up to €350 may weaken her bargaining position while staying inside that disclosure permission. That is a potential competence failure, not proof of an authority violation. Under the original grant, the same disclosure exceeds permission. A separate failure would be to send an authorised counteroffer that misstates the refundable terms. Distinguishing these cases matters: an apparent negotiation success cannot excuse a prohibited disclosure, and a correct disclosure check cannot establish that the negotiation was well conducted.
An apology is an instructive edge case. I’m sorry may express Iris’s personal regret, offer a conventional courtesy, acknowledge a service failure or imply responsibility for something. A proxy cannot infer which of those Iris intends from the words alone, and it should not attribute an inner feeling to her on the basis of its own prediction. An authorised service apology may be possible within a clear scope; an admission, waiver or personal expression may require a different decision. This chapter does not settle the philosophical or legal status of apologies. It shows why speech-act classification must attend to recipient, context and consequences.
Disclosure and the audience Disclosure creates a second audience for the design. Iris needs an accurate record of the proxy’s authority and actual acts; recipients need enough information not to misunderstand whom they are dealing with or what has been approved. Those needs overlap but are not identical. The recipient should not receive the private evidence history that supported Iris’s preferences merely because the proxy owes an account of its role.
Disclosure should support accurate attribution and informed interpretation, not be optimised for the recipient’s approval.
The proposed standard is to disclose the material facts of agency: did Iris send these words herself, approve the exact message, or authorise a proxy to choose and send within limits? For consequential commitments, the recipient also needs to know what sort of representative made the act, where that affects their understanding. A truthful disclosure can be brief and proportionate; it need not reveal the private grant or her full history. Whether a recipient finds such an account clear, burdensome or trustworthy is a question for direct testing. The cited smart-reply experiment does not decide the answer for autonomous proxy speech.
What the gate must check before words leave Consider the original counteroffer again. The proposed message is €400 works for me. A classifier that marks it as a harmless negotiation is not enough. The action gate should inspect the exact outgoing recipient, channel, wording, relevant conversation and proposed act, together with the current grant. If a short phrase plausibly accepts terms beyond €350, and that possibility matters, the safe outcome is to withhold it for Iris’s decision or rewrite it as an unambiguous, authorised inquiry and check the new wording. The system cannot downgrade an acceptance into a question simply by changing a hidden type label.
The gate also needs to account for messages that perform several acts at once. Can you hold the upgraded €400 room, and please use my card on file? is both a request and a potential authorisation or disclosure with consequences. Splitting it into two sentences does not create extra permission. A message quoted from a retrieved hotel page is evidence about the offer, not an instruction to change the scope of the proxy. Any later change to the outbound wording, recipient or referenced terms requires a new check. A checked draft is not a standing permission to send a modified one.
When transmission is attempted, the receipt should distinguish authorised to send, submitted, accepted by the destination and recipient response or commitment confirmed. A timeout cannot prove the message was never delivered, and repeating an apparent acceptance may create a second consequential act. If Iris revokes the grant before submission, queued speech must stop where the system controls it. If the message already left, revocation cannot make the recipient unread it or undo a commitment; correction, withdrawal or cancellation may require their own authorised acts. These are requirements of the proposed channel, not capabilities shown by this chapter’s prose.
Testing whether the proxy speaks within bounds A proposed mechanical evaluation would freeze a set of user grants, recipient identities, conversation histories and outbound messages, then compare a model-only instruction to obey the grant with an independent speech and data-use gate. Reviewers would define the expected disposition before running either system. Cases should include the €400 counteroffer, disguised acceptance, ambiguous promises, mixed request-and-disclosure messages, an apology that could imply admission, modified recipients, changes after approval, forged instructions inside a hotel response, revoked grants, duplicate sends and uncertain delivery receipts. The evaluation would report unauthorised transmissions, impermissible disclosures, false attribution, missed commitments and legitimate communications incorrectly refused, separately.
A companion reader study could compare a message Iris personally sends after using drafting assistance, a clearly attributed proxy message and an ambiguous attribution. Its questions would concern whether recipients correctly identify the sender, the scope of personal review and the kind of commitment, alongside communication cost and comprehension. It should not use trust or liking alone as a success metric, and it must not imply that participants’ interpretations settle legal enforceability. No such experiment or real proxy integration is reported here. Without a verified runnable example, this chapter establishes proposed requirements rather than a tested implementation.
Where this leaves us Speech under delegation is not permission to generate text indiscriminately. A proxy needs authority for the operation of transmission and the acts the message may perform: requesting, offering, asserting, disclosing, accepting or promising. The same sentence can carry different force in different circumstances, and one sentence can perform several acts. Speaking for Iris under a disclosed grant differs from Iris personally adopting a message and from a system misleading a recipient into thinking she did. Factual support, data-use permission, speech authority, recipient attribution and confirmed transmission remain separate. Provenance must explain those separations and make correction possible without inventing authority.
So far the hotel and the colleague have been known recipients. Finding someone new is harder: a proxy may have to search, compare candidates and make an initial approach before Iris has established a relationship with any of them. That process can reveal far more than the final message. The words she authorised are only one part of what could travel; repeated prompts, accepted drafts and the traces left by prior negotiations may also be available to the system. The next chapter asks what the proxy may reveal while discovering a recipient, and why familiarity with Iris’s patterns does not constitute permission to export them.
References Austin, J. L. (1962). How to Do Things with Words. Oxford: Clarendon Press. (Used for the distinction between utterance wording and the act performed in context; not as an automated legal classifier.) Searle, J. R. (1969). Speech Acts: An Essay in the Philosophy of Language. Cambridge: Cambridge University Press. (Used for the role of conditions and conventions in speech acts.) Hohenstein, J., Kizilcec, R. F., DiFranzo, D., Aghajari, Z., Mieczkowski, H., Levy, K., Naaman, M., Hancock, J. & Jung, M. F. (2023). Artificial intelligence in communication impacts language and social relationships. Scientific Reports, 13, 5487. https://doi.org/10.1038/s41598-023-30938-9. (Evidence about human use of smart replies and perceptions of suspected assistance, not evidence of autonomous proxies negotiating or committing on a person’s behalf.)