What the car's agent should never touch

At TechCrunch Disrupt last week, Rivian CEO RJ Scaringe said the company's cars will eventually run AI agents built by other companies, with Anthropic as an example. He gave no date and pointed to Rivian's December AI & Autonomy Day for details. The sentence that matters came next: "You wouldn't want an agent to determine, 'hey, it's time to apply the brakes, or time to steer the vehicle.' So anything that's vehicle-level controls are not being handed to an agent."

That's a carmaker drawing the line out loud while announcing outside agents, and it lands in a week when the agents already in cars got more capable. xAI said Grok Voice 3.0, the speech-to-speech model behind Grok in Tesla cars, now handles millions of conversations a day and can build a multi-stop trip from one spoken request. Grok Bot has been live across Cybercabs and the Model Y fleet since October 11. And Waymo's Gemini companion in its Ojai robotaxi was designed the way Rivian describes: it runs separately from the Waymo Driver, can ask the car to pull over, and cannot steer, navigate, or read real-time driving data.

So the industry is converging on a shape. It's worth naming, because it's also how you should set up your own agent.

Three layers, three different rules

• The vehicle layer: steering, braking, speed, and the decision to drive. No agent touches this, in any mode. The most an agent should do is pass along a request, like Waymo's pull-over, that the driving system is free to refuse. If a product ever blurs this line, that's a reason not to use it.
• The cabin and trip layer: climate, seats, media, navigation, and stops. Voice is already good here, and in Driving mode it actually reduces distraction, because "add a grocery stop on the way home" beats tapping through a map. Low stakes, easy to undo, fine in any mode.
• The account layer: mail, calendar, files, payments, and anything that sends or buys on your behalf. This is where the work lives and where the risk lives. The rules here depend on whether you're driving or riding.

Setting the account layer by mode

In Driving mode, you're the driver even if FSD (Supervised) is steering. Let the agent read to you, capture notes, and draft. Anything that sends, books, buys, or shares waits for a stop, or goes out only from a short list of defaults you set at your desk, like "my usual coffee order" or "tell my 9am I'm running ten minutes late." If approving something means reading a screen, it isn't a Driving-mode task.

In Riding mode, the agent can do more because your eyes are free, but the cabin often isn't yours. Approve from your own phone or laptop, not the shared screen. Keep spending caps and "show me first" on anything that sends money, or messages people outside your team. And a task can still be running when you step out: check what's in flight before you close the door, and make sure you'll get a notice when it finishes or needs you.

A permission card you can write in five minutes

Before your next commute, write this down for your own agent:

• Always fine: reading my calendar and inbox aloud, capturing notes, cabin and trip changes, drafts saved to a folder.
• Fine from a default: a short list of repeat errands and messages I've pre-approved at my desk.
• Needs me at a stop or on my own device: sending to anyone new, purchases above a cap, sharing files, accepting invites.
• Never from the car: credentials, money transfers, and HR, health, or legal matters said out loud.

Then match your connectors to the card. If your agent can reach an account you'd never approve from the car, disconnect it from the car profile rather than counting on yourself to remember.

A good in-car agent is defined less by what it can do than by what it structurally can't.

For builders: the permission model is the product

Rivian's framing is a design pattern, not just a safety disclaimer. Decide which capabilities are unreachable by construction, rather than asking a model to decline. Then make the account layer legible: show what the agent did while nobody was watching, make stopping a task one tap or one word, and decide what happens to a half-finished job when a rider gets out. Coverage of Grok Bot in shared robotaxis has already raised those open questions (voice authentication, privacy, unfinished tasks at drop-off), and nobody has a public answer yet. That's the gap from Builders: the in-car work opportunity, made concrete.

The car companies are drawing the outer line. Drawing the inner one, around your accounts, is still your job. Done well, it's what lets you hand off real work from the car without worrying about it later.