Buzz swaps the org chart for an audit trail

On July 21, Block open-sourced Buzz — a workspace where humans and AI agents are peers in the same chat, the same code, the same workflows. Apache-2.0, built on Nostr, model-agnostic across Claude Code, Codex, and goose. Every participant, human or agent, gets a keypair that Block describes as portable, verifiable, and independent of the platform. Coverage adds that agent actions are signed and chain back to a human owner's key.

It is a genuinely good piece of engineering, and the identity model is the interesting part: attribution is structural rather than reconstructed from logs afterwards. If you have ever tried to answer "which process did this" from a shared service account, you know why that matters.

Now put it next to the calendar. Five months earlier, on February 26, Block cut about 4,000 people from a headcount of 10,205. Jack Dorsey tied the reduction to AI — a significantly smaller team, doing more — and the stock rose roughly 22% on the news.

Attribution is the easy half

Here is the distinction I think the whole story turns on, and it is not a cryptographic one.

A keypair answers which agent acted. It does not answer who is accountable for what the agent did. Those are different questions and only the first is solved by signatures. The second is answered by a person with a name, a role, and consequences — someone who, when the agent books the wrong refund or ships the wrong config, absorbs the outcome rather than pointing at a verified signature and saying the chain is intact.

Buzz makes the first question trivially answerable. That is real progress, and I do not want to undersell it: most enterprise agent deployments today cannot answer it at all, because everything runs through one shared service account and the reconstruction happens in a Slack thread after something breaks.

But the coordination layer that got thinned out was not doing attribution work. It was doing accountability work — the manager who reviews, the reviewer who signs, the person who says no. Those roles are not a logging problem that better tooling makes redundant. They are the part of the org chart that exists specifically to hold consequence.

The bet

So here is what I would put money on, and I will happily be wrong in public.

The first serious dispute over an agent's actions inside a company like this will not be resolved by reading the signature chain. It will be resolved by finding out which human was supposed to be reviewing, and discovering that role was reorganised away. The cryptography will work perfectly. Everyone will agree on exactly which key acted. The argument will be entirely about who was meant to be watching, and the answer will be a job that used to exist.

I am not predicting a scandal at Block specifically — I have no visibility into their internal controls, and their engineering culture is better than most. I am predicting the shape of the failure across the industry, because the industry has enthusiastically adopted the half of the problem that has a technical solution and quietly deferred the half that does not.

Worth being precise about what is verified here: Block has published no internal usage numbers for Buzz, no agent counts, nothing about how it is governed inside the company. The detail that a second signature ties an agent back to its human owner comes from press coverage, not verbatim from Block's own post. I am arguing about a design's implications, not reporting on Block's operations.

The gap in every deployment I have seen

At Trigent this is the question that stops agent rollouts, and it stops them late — usually in the room with risk or audit, after the build is done.

The pattern is consistent. The team can demonstrate what the agent does, show its logs, replay a session. Then someone asks who approves the action class the agent is about to take unsupervised, and the honest answer is that the agent runs under a shared service account created by whoever set it up, and approval was an architectural decision made months ago by people who did not think of it as an approval.

What has actually helped is embarrassingly low-tech: writing a named human against each class of agent action before the agent ships. Not a team, not a function — a person, by name, who owns that action class and knows they own it. It takes an afternoon and it is uncomfortable, because the moment you try to write names down you discover which actions nobody wants to sign for. Those are exactly the actions that should not be running unsupervised yet.

Buzz would make that exercise better, incidentally. If identity is portable and every action is signed, the named owner has something real to review. The signature makes the accountability enforceable — it just does not create it.

Why this reads as more solved than it is

There is a specific way infrastructure like this misleads a buyer. It produces an artefact — a clean, verifiable, cryptographically sound trail — that looks like the answer to a governance question. An auditor can be shown the chain. It satisfies the form of the question.

Then the actual incident arrives and the question turns out to have been "who decided this was allowed," and the trail is silent on that, because it was never designed to speak to it. The tooling is honest about its scope. The organisation reading it usually is not.

Identity is now self-owned and portable by design. Liability, though, stayed exactly where it always was — with the employer. Nothing about a keypair moves it, and no amount of signing distributes it.

A signature tells you which agent acted; only an org chart tells you who answers for it — and that is the half a headcount cut removes.