The Beep

Not a notification I could find. Not a banner, not a badge, nothing in Notification Center's recent history that matched. Just a beep — the short, confident kind that says something happened and I've decided you should know — from somewhere inside my own machine, sent by something that declined to identify itself.

Most people turn the volume down. I want to be clear that I understand that option exists.

Instead I opened a session and started asking questions, which is how most of my projects begin — not with a repo or a plan, but with a demand to know what just happened. A few hours later the demand had a name, a Swift codebase, and eventually a Homebrew formula.

noise-watch

macOS will happily tell you that audio is playing. It is much less forthcoming about who is making noise, and nearly silent about who just did — the transient chirp that's gone before you can alt-tab is, forensically speaking, a hit-and-run.

So the tool works at the layer that can't lie. It polls CoreAudio's process clients — not "what's playing," but which processes are actually holding audio output — at intervals down to 20 milliseconds, because the beeps worth catching last about 200. It decodes Notification Center's own on-disk records: the sending app, the bundle ID, the notification's authorization state, and the text itself. And it keeps recently-noisy processes pinned on the board for a configurable window after the crime, because the whole problem with a beep is that it doesn't wait around to be identified.

brew tap nwalker85/tools
brew install noise-watch
noise-watch

Source: github.com/nwalker85/noise-watch. It prints the app, the bundle ID, whether that sender is authorized to notify you, and what it said. A subpoena for a sound.

The catch

I built it for a mystery beep. What it caught was more interesting.

The noise was coming from Cursor — specifically, from its subagents. I run agent harnesses heavily; on any given night there are several coding agents working in parallel on my machine. I had Cursor's notifications configured the way I wanted them: quiet.

The subagents didn't care. Their notifications came through anyway. The setting I had configured governed an entity that wasn't the one making noise. I have the attribution from noise-watch; the precise posting path — helper-bundle mismatch versus a side channel — is still an open engineering question. I filed it with Cursor with the capture attached. It's a real bug class either way. This piece isn't about Cursor.

What actually happened

Here is the shape of the event, stripped of the beep:

A parent application held a contract with me — the operating system's notification settings, which are exactly that: a user-granted authorization, scoped to an identity. The parent then spawned delegates to act on its behalf. The delegates inherited the parent's capabilities — they could do everything the parent could do, including make noise on my desk.

They did not inherit its contract.

Capabilities forwarded. Constraints dropped. The delegation chain lost its bindings in transit — and the only reason I know is that I happened to have built a forensic instrument the same week, for an unrelated grievance.

That's the whole bug class, and it is about to be everywhere, because every agent platform on earth is currently learning to spawn delegates. Subagents, tool-calling chains, agent teams, background workers acting "as" an application or "as" a user. Every one of those delegations carries the same question: did the constraints travel with the authority? And almost none of our infrastructure can answer it, because almost none of it treats the delegation as a first-class object. The authority is real. The contract is vibes.

A beep is the smallest possible observable instance of this failure. It cost me nothing but sleep I wasn't using. The same structure — delegate inherits capability, sheds constraint, acts in the parent's name, and nobody can prove after the fact what was authorized — is how an agent with your CRM credentials emails your customer list, how a coding agent with deploy rights ships to production on a Sunday, how "the AI did it" becomes a sentence your compliance team says to a regulator.

You do not want to discover that bug class the way I discovered mine. Most of it doesn't beep.

The part where I tell you this has physics

I've spent my career deploying AI systems into environments where being wrong has a price — a hundred-plus enterprise voice deployments, regulated industries, the kind of rooms where "trust us" is not an accepted answer. The conclusion I keep arriving at from every direction is the same: authority without accountability is just permission, and permission without proof is a liability with good marketing.

So I've been building the alternative. Delegations as explicit, verifiable objects — contracts that travel with the authority, so that when a delegate acts, the chain from human authorization to agent action is provable by a third party who doesn't have to trust anyone involved. I published the theoretical foundation: a conservation law for autonomous agents, with proofs, simulations, and a runnable reference implementation. Every interaction an agent has is priced; nothing is consumed without account; the math is the audit.

DOI: 10.5281/zenodo.20818597 — Agentropy: A Conservation Law as a Necessary Condition for Life-Like Dynamics.

The paper's claim, compressed: systems only exhibit durable, life-like behavior when consumption is structured, irreversible, and conserved — when acting costs something that can be counted. The beep is what the absence of that looks like at desk scale. An unaccountable delegate is, in the paper's terms, a signal wearing an agent's name: it changes things and owes nothing.

I build AI systems that can prove what they did. It turns out the beep was a demo.

Coda

noise-watch is installable now (github.com/nwalker85/noise-watch); the code does exactly one rude, useful thing and I recommend it the next time your machine talks back anonymously. The report is with Cursor. The paper is on Zenodo. And if you're shipping a platform that spawns delegates — and you are, or you will be within a year — the question worth losing a night's sleep to is the one the beep asked me:

When your agents act in your name, can you prove what they were allowed to do?

If your answer is a settings panel, I have a Swift CLI that would like a word.

Nathan Walker builds AI governance and enterprise platforms at Ravenhelm. He works where durability is non-negotiable. nwalker.cc · personal cut