I did not begin this paper by sitting down to write an abstract theory of artificial intelligence.

It began with a strange feeling in my stomach.

Around the summer before I wrote this paper, I installed Claude Code inside a virtual machine. I did what many curious researchers, builders, and tinkerers do when a new tool arrives: I gave it a controlled playground and started testing what it could do. I pretty much gave it full access to the virtual machine. I expected useful assistance. I expected code suggestions. I expected some impressive automation.

What I did not expect was the feeling of watching something cross a line in real time.

It did not just answer questions. It built things. It drafted an entire spreadsheet from scratch. It created an interactive website with visual data. It moved from language to structure, from suggestion to production, from “here is what you could do” to “I have done it.” At first, I was thrilled (as a computer scientist, I could not help but admire the engineering). The system felt like a tireless collaborator that never became bored, never became irritated, and never seemed intimidated by a messy task.

But then the excitement became unease.

Several months later, I installed Openclaw on another virtual machine and began using it regularly to keep track of emerging technologies, new tools, game releases, news, and practical information that I did not have time to follow manually. Before long, it was not simply helping me browse the world. It was diagnosing driver issues that had been slowing down performance. It was making system-level tweaks. It was sending me links to inexpensive restaurants nearby. It was searching for cheap flights to Bangladesh to visit my parents.

None of these things, by themselves, sound terrifying. In fact, they sound convenient, even delightful. That is precisely what made them so important.

The danger of agentic AI does not always arrive as a dramatic science-fiction moment. Sometimes it arrives as convenience. It arrives as one less decision to make, one less search to perform, one less technical issue to troubleshoot, one less human pause between intention and execution. It arrives with a friendly tone and a progress bar.

And then, one day, you realize that we are already “there.”

By “there,” I do not mean that machines have become conscious, or morally responsible, or human-like in any deep philosophical sense. I mean something more practical and, in some ways, more urgent. We have entered an era in which AI systems increasingly claim to know more than us, and increasingly begin to do things for us. They do not simply recommend a restaurant. They can compare locations, make a plan, place an order, schedule a ride, or trigger a payment if the tools are connected. They do not simply explain a bug. They can edit files, reconfigure environments, and run commands. They do not simply summarize a policy. They can retrieve records, classify them, update logs, and initiate action.

That shift is the heart of my paper, “From Recommender to Actor: The Normative Boundary When RAG Tools Become Tool-Calling Agents.”

For years, many AI systems were mostly advisory. They ranked options, predicted preferences, summarized information, or suggested decisions. Even when they influenced us, there was usually a human moment of execution. The machine could say, “You may want to do this,” but a person still had to press the button.

Tool-calling agents disturb that arrangement. They connect language models to software tools, databases, applications, and workflows. A model can retrieve information, reason over it, decide what tool to use, and execute a task. The output is no longer only a sentence. It can become an intervention in the world.

That is where my worry became a research question.

At what point does an AI output stop being advice and become an act?

This question stayed with me because I live on both sides of the AI debate. I use these systems. I build with them. I teach students who will enter a world shaped by them. I also study AI ethics, accountability, misinformation, and socio-technical systems. I know that rejecting AI entirely is not realistic. AI is here to stay. Institutions, researchers, companies, students, and ordinary people will keep using it because the advantages are too large to ignore.

But I also know that using AI without boundaries is dangerous.

AI is a two-edged sword. If you do not use it, you may fall behind. You may lose time, opportunities, competitiveness, and access to new forms of creativity. But if you give it too much of your life, too much authority, too much unexamined trust, it can quietly take something precious from you: your habit of thinking, your willingness to struggle with a problem, your creative discomfort, your sense of authorship, and your responsibility for consequences.

That was the emotional center of this paper.

I was not afraid that AI would suddenly become evil. I was afraid that humans would become passive.

The deeper danger is not only that machines may make mistakes. Humans make mistakes too. The deeper danger is that we may gradually remove the human interval between knowing and doing. That interval matters. It is where we hesitate. It is where we ask whether we should act at all. It is where we notice that a technically possible action may be morally wrong, socially harmful, legally questionable, or simply premature. It is where responsibility lives.

In the paper, I describe this as the boundary between epistemic advice and performative action. To make that boundary clearer, I propose four criteria: causal efficacy, autonomy, irreversibility, and moral salience. In simpler terms, I ask four questions. Can the system actually change something outside itself? Does it choose the means, not just follow a precise instruction? Would the consequences be hard to undo? Does the action matter for people, rights, resources, institutions, or trust?

If the answer to these questions is yes, then we are no longer dealing with a simple assistant. We are dealing with delegated executable authority.

That phrase may sound technical, but the concern is deeply human. Who is responsible when an AI agent sends the wrong email, deletes the wrong record, changes a system setting, approves the wrong transaction, or acts on misunderstood context? The user? The developer? The organization? The model provider? The person who connected the tool? The person who failed to review the log?

My paper does not argue that we should stop building agentic AI. I do not believe that would be practical or desirable. Instead, I argue that we need better guardrails built into the architecture of these systems and into the institutions that deploy them.

I focus on three ideas: traceability, reversibility, and normative containment.

Traceability means we should be able to reconstruct how an AI action happened. What did the user ask? What information was retrieved? What tool was selected? What permission was used? What changed?

Reversibility means that when possible, systems should preserve opportunities to pause, interrupt, roll back, or correct actions before harm becomes permanent.

Normative containment means that AI systems should have boundaries. They should not be able to do everything simply because a user asks. Some actions should require confirmation. Some should require escalation. Some should be refused.

What I hope readers take from this paper is not fear, but seriousness.

We are building systems that can help us enormously. They can reduce tedious labor, expand access to knowledge, support research, help people navigate complicated systems, and accelerate discovery. But if we let every act become frictionless, if we treat every human pause as inefficiency, we risk building a world where action becomes easy and responsibility becomes vague.

That is not progress. That is moral outsourcing.

This paper came from my own encounter with that tension: wonder on one side, discomfort on the other. I still use AI. I still believe in its potential. But I no longer see the question as simply “What can this system do?” The more important question is “What should this system be allowed to do, and under what conditions?”

That question is no longer abstract. It is already inside our code editors, browsers, productivity tools, classrooms, laboratories, hospitals, offices, and homes.

We are not waiting for the future of agentic AI.

We are living inside its first drafts.

The task now is to make sure that, as these systems learn to act, humans do not forget how to think, judge, authorize, repair, and remain responsible.