Last week my hospital's security team scheduled a brief touch-base on Microsoft Teams. The reason sat in the alerting system, in phrasing stiffer than everyday English: a DPAPI-based credential extraction had been detected on my hospital-issued laptop — roughly, a program had read the login credentials that the Microsoft Edge password vault keeps encrypted. Such words can be alarming. In the American context, it is not merely rhetorical that an Asian-background immigrant engineer employed by a public institution might find his "suspicious activity" ending with police and courts. The history of the Computer Fraud and Abuse Act includes an era when prosecutors argued that violating an employer's computer-use policy could itself constitute a federal computer crime; the Supreme Court narrowed the statute's reading in 2021 (Van Buren v. United States), but institutional memory of risk outlives court decisions.
My answer was simple: the alert was mine. Inside the hospital's internal network I have privately deployed an AI automation stack — the model is Qwen, an open-source release from a Chinese company, running on hardware that an ordinary laptop could not power. On the issued laptop itself runs only an open-source agent that calls it across the internal network, scripting away the repetitive parts of my daily operations work. I was reading credentials I had stored in my own browser, doing work my position is authorized to do. The security colleague's reply was equally professional: generally speaking, this counts as unauthorized; put strictly, a credential compromise. I asked: is it prohibited under hospital policy? No, she said.
I did not contest the label. I only filed away the distinction that moment taught me: "not prohibited" and "granted permission" belong to two different languages of governance. The first is the logic of criminal law — no punishment without an explicit statute; the second is the logic of bureaucracy — no act without permission. My little automation had fallen into the seam between the two languages.
Authorization as a procurement status
Start with an economics commonplace, because it is the key to every workplace "rule": firms exist because hierarchy replaces some market transactions — the question Coase answered seventy years ago. What is peculiar about employment is not that employees are smarter but that the organization has purchased the power to allocate resources and risks within set boundaries. Tools are issued by the organization, processes are defined by the organization, errors are covered by the organization's insurance — this is hierarchy's traditional bargain.
Personal AI agents crack that bargain for the first time. The private tools of the past — your calculator, your own scripts, your dictionary subscription — carried no identity and touched no system boundary, so they were never objects of governance. The bring-your-own-device era breached the boundary once; organizations answered by installing a monitoring agent and preserved the old framework. An AI agent is different in kind: it holds credentials and executes actions. It is the first employee shadow that carries its own ID badge. When the shadow does what the formal employee is authorized to do, the organization's authorization scheme has no box prepared for shadows. And here a symmetry becomes visible: the hospital's own multibillion-dollar medical-record platform — those in the industry know which one I mean; Epic needs no disguise — is famous for closed interfaces and black-box data flows. Vendor processes do far more on my machine than my little agent ever did, yet because they are written in a procurement contract, they are born "authorized." An employee script that reads its own passwords and does its own job becomes unauthorized only because it did not go through procurement. In institutional semantics, authorization turns out to be a procurement status, not a property of the act. Whatever flows along capital and contracts is safe; whatever flows along individuals and habits is risk.
Zoom out one more notch and you get the political economy of care. The American health system has turned a capability that a society is supposed to share into a sustained claim on household budgets and time; midstream in the procurement chain sit a few closed platforms. Closedness is not original sin. But when an institution outsources its efficiency to black boxes and reserves its alarm for the transparent little tool in an employee's hand, what it protects is probably not safety — it is the sense of control that the process itself represents.
One email, two arithmetics
After that touch-base, the second thing I did was write an email to my direct manager: the security team contacted me; here is what happened; please let me know if you have any objection. I sat looking at the screen for a while after sending it — because the gesture is two different arithmetic problems in different societies.
In much of East Asia, such an email reads as handing your leader a problem: you ran into trouble and now make the boss take a position; discipline points come off first, and the incident itself is nobody's business to examine. In American institutional culture, the paper trail performs the opposite function: I disclose, you are informed, your silence is consent; if anyone asks later, the question is "did you violate a rule that was made known," not "did you once do such a thing." Both are risk-allocation mechanisms; they merely allocate differently — the former leaves risk attached to one's standing inside the organization, the latter hands the right to know, together with responsibility, to a superior.
My arithmetic carries one more factor. As an immigrant of Chinese background, I calculate differently: the worst case for a local colleague is finding another job; mine can keep descending along a chain of professional discipline, credit, and immigration status. Sensitivity to risk is not cowardice; the cost functions are simply different. What the email will earn — responsible transparency, caught, or merely a chance for the boss to take a position — I do not yet know. It is a small Rorschach test: from its fate one can read whether this institution treats employees as risks or as colleagues.
Model nationality, data paths, and the real national-security question
The question security people will surely ask, I have asked myself: you are using a Chinese open-source model. That question carries two anxieties, one legitimate, one confused. The legitimate part: any architecture that hands data to outside processing should be asked where the data goes and who gets to audit it. The confused part: treating model nationality as itself a security attribute. In my deployment the model sits on the inside of the hospital's firewall, data does not cross out, credentials never leave the machine, context is supplied only at the minimum needed — and patient data never enters the model at all. The part being automated is the most privacy-boring trivia between a man and his machines. But institutional intuition can hardly be calibrated by data path, because data paths are invisible; calibrating by nationality is convenient — nationality, at least, is printed on the package.
This is the embryo of a general condition. Once employees routinely process official business through private AI, the true risks to national security and to patient privacy (HIPAA's domain) will not lie in any single DPAPI alert but in the fact that nobody can draw the data-flow diagram — including the respectable black boxes bought under contract. Today's rules do not draw that line not because nobody has thought it through, but because drawing it means somebody must sit down at the desk labeled "responsible for personal productivity tools." The institution's three available paths therefore lead to the same place: explicit prohibition is pretense; provision carries liability; looking away is the cheapest — normally you quietly gain efficiency, and when things go wrong you carry the blame alone.
I would propose a fourth path, an institution one might call default authorization: any personal agent that is local-first, touches no protected health information, is registered and revocable, counts as a permitted extension of the job; the organization keeps the right to spot-check, not the right of prior approval. Its substance is to return authorization from a procurement status to a property of the act — the door should recognize the person, not the brands the person carries. Such an institution, of course, requires someone willing to write the policy and organizations willing to pilot it. In health care, those two things are scarcer than chips.
The counterfactual: hospital IT maintained wholly by AI
Everything so far is still about maintenance. I will risk one counterfactual at institutional scale: what if hospital IT — from integration interfaces to the operations of the record database itself — were handed wholesale to AI? The answer is double-edged in every dimension, which is why it is worth stating.
Employment first. The American hospital system carries a vast middle layer: system administrators, integration analysts, implementation consultants, training specialists, compliance officers — and, most crucially, managers of managers. Much of what this layer does, frankly, is carry context between humans and systems, exactly the genre an AI agent replaces best. The irony of the shock: the closer a job stands to the patient, the safer it is; the closer it stands to the interface, the riskier. Those near the interface are often the once-respectable middle-skill jobs that require no license. How a labor market digests the mass evaporation of such jobs — the past ten years have already given politics ample demonstration material.
Management. American healthcare governance is, at bottom, a system of signatures: changes need tickets, tickets need approvals; even a single number is reviewed and approved on a schedule by a designated manager. What does the ritual actually guard against? Strictly speaking, not error — machine review does not tire — but responsibility without an owner. The regulatory chain (Medicare rules, state health inspections, HIPAA Security Rule audits, accreditation standards) legally presupposes a reasonable human supervisor; liability, professional insurance, compliance frameworks are all built on the ancient assumption that when things go wrong you can walk up to a person. AI operations do not disrupt technology; they disrupt the assumption. When the signer no longer understands the system he signs for, signature degenerates from judgment into witness. Full automation corners this hypocrisy: either admit that machines can be held accountable — our law has no box for accountability beyond the legal person — or admit that human signatures have long since been ceremony.
The privacy ledger is the most subtle. Intuitively, letting an AI touch the chart system day and night is unsettling. But the principal leak surface of patient privacy today is human convenience: pulling up a record out of curiosity requires no reason, and a screenshot or a clipboard export travels a path no audit covers. Machine maintenance can be harsher than human — fine-grained authorization, minimal context, a full trail by nature. On accident probability alone, privacy under full automation may improve; what it buys is a new asymmetry: human peeking cannot be priced, and machine omniscience cannot be cross-examined. A record vault guarded only by algorithms is technically safer and politically harder to trust — and health institutions have always been designed by trust-feel, never by accident rate.
Research — and the true beneficiary of this revolution. If health data were continuously cleansed, labeled and aligned by automation, the thresholds of real-world research would collapse: rare diseases lose their silent cohorts; adverse-effect signals surface from tens of millions of charts; every patient's contributed data comes, at last, close to being fully redeemed. Science grows richer. Now read the industry's balance sheet in the other direction: the moat of the closed platforms rests precisely on human-mediated complexity — integration is billed, configuration is billed, "making systems talk" is itself a priced service. Automation turns complexity into tap water, and turns a class of billable items back into infrastructure. Liberation for science; for the industry, a revolution with a wide footprint of destruction. The two words sit on the same ledger.
One might have hoped that long-term semi-automation is the stable middle path — individuals adopting without asking, institutions waiting for one accident before writing policy, the system holding equilibrium in the meantime. Anyone reasonably wary of human nature should doubt that equilibrium. As long as humans remain in the loop, they will not maintain the loop; they will keep inventing new loops — new approvals, new paths, new "necessary" complexity, because the loop is their reason to exist. Once approval's function shifts from judgment to liability defense, its quantity is constrained no longer by judgment but only by imagination; Parkinson's old law revives in mirror image: approvals do not fill time the way work does — they fill the system the way inflation does. Semi-automation, then, is not a road one can live on; it is a toll plaza endlessly adding lanes, efficiency eaten back procedure by procedure, until some shock — labor shortage, a vendor price hike, one accident, one budget line — forces the jump. After a single alert, the institution's choice remains the same two: design the path, or let it flood under your feet. The price of the second option can now be quoted precisely: not standing still, but buying dignity for old jobs with new complexity — the bill, as always, addressed to patients and taxpayers.
Customized genetic services: a national competitiveness — with AI as its information substrate
Everything discussed so far is maintenance, and the end of maintenance lies beyond this topic. Look five or ten years ahead: medicine is moving from treating disease to maintaining the person — autologous stem cells, individualized genetic maintenance, organ regeneration. Such services sound today like fashion for the rich, but their economic character is what deserves to be written down: wealthy clients, dense data, demand near-inelastic. This is not a department; it is a new lane of national competitiveness. Whoever makes life extension cheap, safe and accessible keeps not only its wealthy citizens' wallets but also the talent, the firms, and the right to draft the standards.
The binding constraint of these services lies precisely in information. One client is one continuously growing dataset — genome, imaging, longitudinal laboratory sequences, the genealogy of cell lines, post-transplant immune responses — and the frequency and dimensionality of decisions long ago crossed the processing ceiling of the human brain. Here AI is not an efficiency option but a cognitive prosthesis: not "faster with it," but "blind without it." So the real puzzle of this essay returns in its sharpest form: will America allow this new medicine to couple with its existing health-care industry? The new medicine needs information infrastructure as young as itself; a middle layer that lives on approval can offer nothing older. The contradiction fits flush: longevity services most need to trust AI, and American health-care governance most dares not — accountability, the right to sign, insurance and litigation chains, all built on the old assumption of a responsible human supervisor. Failure of coupling will not announce itself as prohibition. More likely: the experiment is completed at home, the scale-up abroad, and the bill and the jobs follow the scale-up. And in jurisdictions without an incumbent platform's historical baggage, with state mobilization already on the shelf, those with the least to lose are often those with the most to gain.
How new social and workplace ethics get built along the way — who signs, who answers, who is watched, and whether a person's data body belongs to the person — is far beyond this blog's reach. One farewell line, then: physical immortality may arrive before institutions update themselves. Whether a society can catch it will depend not on technology, but on whether its institutions are afraid of living too long.
Where the boundary lies
I do not regret the email. The boundary of AI at work is written today between a law that lags and a practice that gallops: for the individual, what is reliable is the written record, the ancient procedure that silence equals consent, the choice to keep "unauthorized" in the open rather than in hiding; for the institution, what is reliable is writing personal agents into policy language soon, instead of leaving improvised legislation to an alerting system. The alert will pass; the question will not. The shape of the problem is not new — every time a technology frees individuals from the guardianship of process, institutions are made to answer the same old question: do you trust the chain, or the person? I will wait and see.
