PERSONAL AGENT
Tenon
I designed and built Tenon to keep delegated plans coherent when prices change, flights slip, or a person needs to take over.
When the terms change, Tenon asks you to review them again before booking.
The turning point
An approval belongs to the version you saw.
Personal agents now handle real errands. The hard part comes after the handover: a fee posts while you are looking at the total, a flight slips, a business refuses to deal with an assistant, or you pick the plan back up on your phone.
Tenon acts alone only where a mistake is cheap to undo. When the terms change, the first review is withdrawn and a new one shows the old price struck beside the new. A language model maps what you say to one of seven intents; fixed rules decide the rest. A fee mid-review costs a second look, never a charge you didn’t see.
Total
A fee posts mid-review.
The total moved
A hotel adds a fee while you are reading the total you are about to approve.
The flight slips.
The plan stopped holding
A delay breaks the plan you approved, after you handed it over.
Stewart Street Inn
Direct bookings only
We don't deal with assistants.
A business said no
Stewart Street Inn only takes bookings directly, so the agent cannot finish the booking.
Picked up on the phone.
The person stepped back in
You pick the plan back up on your phone, partway through.
Loading Tenon
My role
I led Tenon's task model, interface and working build.
My responsibility
I decided what the agent may do alone, what waits for a person, which version an approval applies to, and who owns each item.
I worked with the founding team on one task model for both journeys, laid out for desktop, tablet and phone.
The Wren on Pine
- First review
$640Withdrawn - New review$676Waits for your OK
How I worked
Set autonomy by the cost of a mistake. Tenon acts alone only where a mistake is cheap to undo. Anything that charges a card or changes a booking waits for the person.
Gave the model one narrow job. It only turns a typed message into one of seven bounded intents. Deterministic code decides totals, holds, ownership and confirmation.
Designed for the hand-back. A weekend in Seattle and a dishwasher repair run on the same task model, so a person can step in or pick the plan up on any device.
How it works
A language model sorts each message into one of seven intents; code decides totals, holds and confirmation.
You say
We now land at 8:30 pm.
The model hears
Tenon read your message
- Intent
- New arrival
- Time
- 8:30 pm from your message
- Day
- Fri Nov 6 from the itinerary
One of seven intents. It never sees prices, bookings or permissions.
The code works it out
Arithmetic and fixed rules, not the model. The 8:00 table is too early.
You decide
Tenon checked dinner against your arrival
Dinner at Sorrel & Salt
Changing a booking waits for your OK.
- Progress saved Across tabs and a handoff link
- Try every scenario, full screen
Decisions
Four decisions define how Tenon behaves.
Each one is a rule in the engine, visible in the product, with the cost I accepted for it.
Tenon acts alone only where a mistake is cheap to undo.
The brief carries three standing permissions a person can read in one glance. Tenon researches and books a table with no deposit on its own, then says so. Anything that charges a card or changes a booking comes to you. Messages to other people are drafted and left for you to send. These are the three questions the Judgment instrument used to ask with sliders (can it be undone, what does an error cost, who else is affected), now answered by what the product does.
Stripe describes the Muse checkout as a purchase the person approves, paid with a single-use card scoped to that one purchase.
Every card charge is a tap you make yourself. In exchange, nothing that costs money happens while you aren't looking.
Every review carries a version and a hold time.
When the hotel adds a fee while you're reading, the first review is withdrawn and a new one shows the struck $640 beside $676, with the terms that did not change listed underneath. An old button, a view that hasn't refreshed, or a second device can't push the earlier version through: the engine refuses it and says what already happened. Approvals made offline wait and are checked again on reconnect.
Human-in-the-loop workflows suspend on a decision, resume only on that decision, and time out rather than wait forever.
A fee posting mid-review costs you a second look. It never costs you a charge you didn't see.
When a business won't take an assistant, the work moves to you, prepared.
Stewart Street Inn only takes bookings directly, and a hotel can refuse assistants mid-booking. Tenon doesn't work around that. It pauses on the stay, hands you the guest names, dates, quoted rate and arrival note ready to copy, and marks the item as yours in a band nobody can miss. When you hand it back, it shows exactly what you changed, records it as done by you, and rechecks the budget.
Amazon blocked Meta's Muse from shopping on its site, citing disclosure and how the agent identifies itself.
You do the provider's step yourself. The comparison, the details and the rest of the trip carry on without restarting.
A timeout is not a yes, and not a no.
If the hotel doesn't answer within 30 seconds, the stay moves to Checking, the booking button stays gone, and Tenon asks for the booking status before anything else. If the reservation exists, it's confirmed once. If it doesn't, you get a fresh review, and nothing was charged.
Payment APIs treat a retry after an unknown result as a repeat of the same request, not a new one, so it can't charge twice.
The rare slow reply takes longer to resolve. A double booking can't happen.
One task, three layouts
A desk for comparing, a phone for deciding.
On a desk or a tablet, the plan and the current decision sit side by side, so a change can be checked against everything it touches. The phone leads with the decision and keeps its action in reach of a thumb. All three read the same task state.
The phone keeps the decision
What changed, what stayed the same, the terms, and one action within reach of your thumb.
The phone drops the comparison
The side-by-side stays on the desk. The plan sits one scroll below.
Nothing is retold
Each layout reads the same task at the same version, so a decision made on one shows as made on the other.
The opportunity
The plan you approved stops being the plan that executes.
Personal agents now handle real errands. The hard part comes after you hand one over: a fee posts, a flight slips, a business refuses to deal with an assistant, you step in to do one part yourself, or you pick the task up again on your phone. I designed for that part.
Informed by current personal-agent workflows.
The baseline is strong. Meta's Muse already ships purchase approvals, goals and activity views, editable memory and generated documents.
Businesses set their own boundaries. Amazon blocked Muse from shopping on its site.
Useful, and a little too close. A hands-on reviewer found everyday tasks genuinely useful and the access uncomfortable.
Why every booking waits for your OK
Agent benchmarks give context for this rule. They did not evaluate Tenon.
The same tasks, asked four times
Muse Spark 1.1Meta
Handoff and return
The stay changes hands twice and nothing is lost.
Four steps from the takeover path, and who can act at each one. Try it below: book the inn, pick a king room, hand it back.
Confirmation SSI-20931.
The build
Each rule lives in the engine, and the build checks it.
The Wren on Pine
Still within your $700 hotel budget.
A fee posting mid-review costs you a second look.
It never costs you a charge you didn't see.
- Approvals
- Expiry
- Timeouts
- Takeover
- Cancellation
41 automated checks.
Approvals, expiry, timeouts, takeover and cancellation.
The rare slow reply takes longer to resolve.
A double booking can't happen.
Compare notes
Working on a product that’s still taking shape?
More work