An AI agent is a vendor even when it lives in your browser

The strange part isn’t that the agent is clever.

It’s that it knows the customer history you pasted into it, remembers last week’s exception, and can now open the system where that exception becomes real.

The person beside you knows the work. The thing in the tab has the record, the pattern, the prompt, the permissions.

That produces a particular unease. It isn’t fear of a machine waking up. It isn’t even fear of losing your job, exactly.

It’s noticing that the helpful thing has become the place where your work gets assembled, explained, and maybe decided.

You still do the work.

The work has just started living somewhere else.

You’re not weak for taking the help. You’re tired. You’ve got deadlines, messages, a child to collect, bills, and a stack of decisions that don’t become noble by being repetitive.

When a browser tab offers to turn a customer history into a usable answer, you say yes. That isn’t a private plot to redraw the company boundary. It’s you getting through an afternoon with what’s on the desk.

Leave the overlords out of it.

Something duller has happened to you.

A supplier relationship arrived disguised as a convenience feature.

2008 — You download a spreadsheet template from a vendor. It helps. The file still lives on your desktop.

2016 — A cloud app remembers your team’s preferences. The useful version of the process starts living in its account.

2024 — You paste in the customer history for a better answer. The tab knows enough to sound like it was in the meeting.

2026 — The agent has its own permissions. It isn’t only helping you think.

Your tab is a boundary

The old name for this is make or buy. It sounds like a meeting where somebody points at a spreadsheet, which is part of why it vanishes when the purchase feels like opening a tab.

But make-or-buy isn’t a procurement rule. It asks why a recurring activity sits inside a firm’s authority, or with an outside supplier, or in some hybrid of the two.

And the unit isn’t your whole job.

It’s the transaction.

A manufacturer makes the precision subassembly, buys commodity fasteners, and co-develops the interface with a specialist. Make, buy and ally are three forms of governance, not three moods.

That’s a far more useful picture of your agent than “we bought AI” or “AI replaced the team.”

Yours may draft customer replies while you keep the decision to send them. It may retrieve a contract while a controlled system decides whether a bank record changes.

It may be a hybrid: outside model, inside data, a vendor connector, and you holding a decision right.

The cheerful story calls that augmentation.

The colder story calls it replacement.

Neither one tells you who governs the work.

That’s the correction. You’re not buying intelligence. You’re choosing who gets to govern a piece of your job.

The price is the beginning

Make-or-buy starts with a mildly annoying fact. The listed price is not the cost of using a market.

Buying also means searching, qualifying, negotiating, specifying, monitoring, arguing, and rewriting the arrangement when the world moves. Making costs too: supervision, bureaucracy, internal bargaining, slow decisions, weak incentives, honest managerial error.

Your boundary sits wherever one arrangement’s expected cost and hazard first exceeds the other’s.

Three things make that comparison hard. Asset specificity, uncertainty, frequency.

Asset specificity is the knowledge, tooling or investment that loses its value outside this particular relationship. Uncertainty is whether you can specify and verify the future work. Frequency is whether repetition justifies a dedicated arrangement.

They’re proxies for contracting difficulty. They aren’t a score that knows your answer.

Your subscription looks cheap because the invoice doesn’t show what’s becoming specific.

The prompt library absorbs your strange cases. The vendor’s memory holds your team’s terms. The connector becomes your route to the customer system. The model gets tuned to a pattern that started as your local judgment.

Later, another supplier is technically available and practically unreachable. Because the real asset was never the chat window.

It was your accumulated way of doing the work.

Which is why core competence isn’t a sentimental argument for keeping everything in-house. A capability is an organized capacity — people, routines, technical knowledge, data, assets and decisions producing an outcome together.

Prahalad and Hamel made the case in Harvard Business Review in 1990. What matters is the shared know-how sitting underneath several products, hard for a rival to copy or buy.

An outside specialist may genuinely be safer for common, transferable work. The question is what your employer still has to understand, improve and direct.

Permissions tell the truth

The moment your agent touches a tool, “it’s just a tool” starts to fail.

A tool can read. It can create something reversible. It can commit a business, legal or physical change.

Three different effects. Your tab stopped being the boundary the day it could read a case, draft a change, and reach into a system whose rules it doesn’t own.

And who’s acting, exactly?

The agent service needs a machine identity, separate from your identity, and separate again from the identity of whatever tool it calls. That isn’t fussiness.

Authentication answers who made the request. Authorization answers whether that identity may do this action, on this resource, for this purpose, now.

Those are different questions with different answers, and a friendly interface will happily blur them for you.

OWASP names three ways an agent gets dangerously broad. Excessive functionality. Excessive permissions. Excessive autonomy.

Read them as three ways a supplier ends up doing work nobody bought.

The remedy isn’t a politer warning in the prompt. Give it only the operations the job needs. Bind each one to narrow authority. Gate anything material or hard to reverse.

Your reassuring sentence in the browser isn’t evidence. The system’s response is.

The vendor you can’t see

Here’s where the old theory gets uncomfortable.

Agency cost has three parts: what a principal spends monitoring, what an agent spends proving itself, and the residual loss nobody prevents. Bringing work in-house doesn’t dissolve any of that. Employees conceal things and chase local goals. Suppliers shade quality and hunt change-order rents.

The question was never which side has better people. It’s which incentive problem you can actually govern in the arrangement you picked.

Ownership sharpens it. Grossman and Hart’s 1986 account is about residual control rights — who decides the uses of an asset that the contract never settled.

In your agent relationship, the unsettled decisions are everywhere. An API change. A model update. A memory policy. A connector’s new capability. A retention rule.

The interface feels personal. The residual rights live somewhere else.

Resource dependence gives the feeling its name. Dependency grows when a resource matters, alternatives are scarce, switching is costly, information is thin, or a supplier owns a bottleneck.

Pfeffer and Salancik weren’t arguing that all dependence is bad. A specialist can supply something no firm should rebuild.

They were asking what you keep. Credible alternatives. Technical understanding. Contractual rights. Buffers. Influence when the interruption comes.

And the theory isn’t a verdict machine. Its central costs are inferred, never directly observed.

More research doesn’t turn a latent coordination cost into a line item. A firm can mistake cause for selection: maybe the volatile work went outside, or maybe the internal unit holds knowledge its price never showed.

There’s no honest route from any of that to “the economics made us do it.” Power, distribution and politics aren’t transaction costs with the names rubbed off.

That matters because your browser agent can redistribute authority without anybody saying so out loud.

It moves discretion away from the person who knows the customer, toward whoever owns the policy, the connector, the model configuration, the approval queue.

It can also be telling you something true. Nobody routes work through an unsanctioned tool because the official route was serving them beautifully.

The exposure risk is real. So is the evidence that the sanctioned path failed to deliver on time. Both.

The old question didn’t disappear when the interface got friendly. It got easier to start and harder to see.

You thought you were accepting help with a task. You probably were.

But once your agent has the capability, the data and the rules, the boundary has already moved.

The only question left is whether anyone will admit where it went.