user-steered agent
A user-steered agent is an attended individual agent that runs as a session attached to a person. The person opens it, gives it a task, watches it call tools, and decides each next step, as with Claude Desktop, Claude Code in a terminal, Cursor in the editor, and ChatGPT.
User-steered agents run in a chat window, terminal, or editor while a person guides the session. The agent can make plans, use tools, and carry out multiple steps, while the user watches the process and chooses what to do afterward. A session can even move between Claude Code, Cursor, and Codex without changing type, because a person still steers it.
In the four types of AI agents defined by accountability and engagement, this is an attended individual agent. User-steered describes the interaction pattern, while attended individual names the working arrangement.
How do user-steered and background agents relate?
A user-steered run is tied to one person’s active session and is therefore attended and individual. Background is not its strict opposite. It describes where or how work executes, so a user-steered agent can start a background operation and remain attended while progress streams back. The run becomes unattended only when active participation is no longer required.
| User-steered run | Background run | |
|---|---|---|
| Engagement | Attended | Often unattended, but can remain attended |
| Accountability | Individual | Individual or organization |
| Starts from | A person’s active session | A request, schedule, queue, event, or system signal |
| Authority | Usually delegated-user authority | Delegated-user, service/workload, or hybrid authority |
| Example | Claude Desktop, Claude Code in a terminal, Cursor in the IDE | Delegated cloud coding or a nightly organizational workflow |
An internal Slack agent can be an attended organization agent when employees actively exchange messages with it, even if the service persists between conversations. Product architecture and deployment lifetime do not determine attendance.
When does a user-steered agent stop being user-steered?
Stopping steering is often simpler in theory than in practice. The same software acts differently depending on how it’s started.
- Claude Code in a terminal is user-steered and attended individual. The same Claude Code launched by a scheduled trigger is unattended. It is individual if the schedule retains one person’s delegated authority, or organization if it performs a standing organizational job.
- Cursor in the editor is user-steered. Hand the task to a Cursor Cloud Agent and the person assigns it, walks away, and reviews a pull request.
- Copilot in the IDE is user-steered. Assign an issue to Copilot coding agent and the agent decides every step until the pull request is ready.
The delegated runs in the second and third cases are unattended individual agents. They still act on the assigning person’s behalf, so the person’s authority has to travel with the run without the live session. That is the case for a task-scoped credential, minted for the run, naming the person as subject and the agent as actor, and expiring when the pull request lands. A standing organizational schedule instead needs service or workload authority with a dedicated identity and owner.
What agent identity does a user-steered agent use?
Usually the person’s delegated identity. The session logs in using the person’s single sign-on identity, each tool use is approved based on the person’s permissions, and the audit log shows who was in control. This authority model is separate from attendance: an unattended individual agent can also retain delegated-user authority for a bounded task. Agent auth explains the OAuth mechanism that proves the binding to a resource, agent identity explains what is bound, and extending IAM to agents shows how the existing user directory handles the setup.
Three details keep inheritance precise:
- Inheritance sets a ceiling. The agent can never exceed the person’s grants, and most organizations narrow it further, denying the agent destructive calls the person’s own role allows.
- The session records more than the person. It binds the agent workload and the client too, so the same person driving Claude Code and Cursor produces two distinguishable actors. Agent composite identity describes the tuple.
- Offboarding follows the user account. When the person is deprovisioned, every session bound to their identity loses access on the same directory event that disables their login.
How does a user-steered agent lose its governance advantage?
This happens when the agent runs on something other than the person, often through a shared team bot token in an MCP configuration. The agent’s actions are then attributed to the service account. Its access permissions become a combination of teammates’ requirements and are not revoked when a team member leaves. Those are the machine-credential failures listed in non-human identity. A user-steered agent should inherit the person’s identity instead.
How should a CISO inventory user-steered agents?
Count user-steered agent clients
The agents are visible in the agent inventory. Endpoint and MDM tooling detect Claude Desktop and Cursor installed on managed laptops. The identity provider tracks seats and sign-ins, and procurement tracks subscriptions. Counting user-steered agents is often straightforward.
Inventory the tools connected to each agent
Their reach requires separate discovery. An MCP server connected to an editor can appear as a few lines in a dotfile, such as ~/.cursor/mcp.json, and a skill can be a markdown file in a project directory. An endpoint scan can detect the editor while overlooking its connections. Shadow AI addresses this gap. A complete record tracks the person, client software, and connected MCP servers, skills, and tools. Agent hooks within the agent and gateway traffic surface those connections.
How does the Speakeasy AI Control Plane govern user-steered agents?
The Speakeasy AI Control Plane makes inheritance the enforced default for this type. Sessions log in using the identity provider your company already uses, meaning a user-steered agent accesses tools as the person using it, not through a general, shared key. The MCP gateway checks each tool request against that person’s permissions and logs it in audit logs using their name. If the person is removed from the identity provider, their agents lose access at the same moment their login is disabled. When the same person hands a task to an unattended run, the platform switches strategy and creates a task-scoped credential for it. To bind the sessions your organization already runs to the people behind them, talk to us.