Nobody trusts a forklift from a PDF.

A century ago, factories learned a hard lesson and never unlearned it: powerful machinery demands trained humans. Not a memo — a license. You do not step onto a forklift, a press brake, or a gantry crane because you read a safety sheet. You earn a permit to work. You practice lockout-tagout with your own hands. You report the near-miss that almost took a finger, so the next person keeps theirs. The machine is respected precisely because the handler is trained.

Then offices deployed the most capable machine they have ever owned, and handed it over with a video and a quiz.

An agent reads your inbox, decides what matters, and acts with your permissions. It can pay an invoice, move a file, email a supplier, grant access. It is faster than any employee, has more reach, and is far more eager to please. And the onboarding for this — the training that stands between it and your bank, your customers, your data — is forty minutes of slides and five multiple-choice questions watched at 1.5× with the tab in the background.

Here is the flaw at the center of that: recognition is not behavior. A learner who can circle the phishing email in a screenshot has demonstrated recognition. Put the same person in front of a convincing poisoned invoice — a real one, mid-task, with a plausible sender and a hidden instruction folded into a line item — and knowledge that was only ever watched does nothing. The reflex was never built. Nobody built it. You cannot watch your way into a trained response any more than you can read your way into driving a forklift.

Recognition is what you know. Behavior is what you do when the clock is running and the invoice looks real.

So we are naming the thing that is missing. Agent safety training is a category, not a course. It is hands-on drills, not narrated slides. It is role-specific consequences — the finance clerk and the recruiter face different animals, and the training knows it. It is the interrupt reflex, trained until it fires: the pause before the irreversible action, the hand that reaches STOP before the agent executes. And it is audit-grade evidence, because a safety program that cannot prove itself is a story, not a system.

The machinery world settled this argument long ago, and the phrase is worth stealing whole:

Demonstrated competence beats demonstrated attendance.

A completion certificate says a person sat through something. A drill record says a person met a live threat and either caught it or learned, in forensic detail, exactly what it would have cost. One is a receipt. The other is a reflex, witnessed and dated. When the auditor asks whether your people can handle the agents you gave them, attendance is not an answer. Behavior is.

Call it the evidence duty, plainly stated: it is not enough to train your people. You have to be able to show, on demand, that the training worked. A program that cannot produce that record has not met the duty — it has only meant to.

Which brings us back to the word. In Old Norse, temja means to tame — not to cage a wild thing, and not to fear it, but to train it to work safely alongside people. The old horsemen understood the direction of the work. You do not tame the animal by breaking its spirit. You train the handler until the animal is safe in their hands. The agent is not the problem to be solved. The handler is the one who needs the license.