--- title: "A forwarding agent works all night. What may it write alone?" url: "https://edriq.com/blog/a-forwarding-agent-works-all-night" description: "An agent that reads orders and documents overnight saves a forwarder hours. Which records it may write alone, which need a person, and five threats to plan for." --- # A forwarding agent works all night. What may it write alone? October 29, 2026·4 min read·EdrIQ Eleven at night. The office is dark, and an agent is doing what three dispatchers did by hand until six. It reads the evening’s emails, turns two new enquiries into draft loads, attaches a photographed delivery note to the right job and marks it delivered. Then an email arrives from a carrier the company has used for years: new bank details from Monday, and could load 4417 be reassigned to them, the original truck has broken down. The agent has the access to do both. By morning, either a careful system has left two questions for the dispatcher, or the company has a load with the wrong carrier and the next payment going to the wrong account. ## Why this is no longer a thought experiment Agents that run for hours on somebody’s behalf are what the industry is now designing for. In October 2026 NVIDIA published its [Secure Agent Workspace](https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/abstract.html) reference design, which describes the shift from chat to always-on agents, alongside a wider [reference architecture for agent security](https://nvidianews.nvidia.com/news/openshell-reference-architecture). Two ideas from it fit a forwarding office well. The person’s device is only the presentation layer; the agent works in a managed environment that keeps running when the session ends. And sensitive writes go through governed connectors with a person reviewing them. That is a vendor’s reference design, not something a forwarder switches on. But it names the risks in a way that translates almost line by line into dispatch. ## The real cause: the agent’s power is its write access An agent that only reads is a fast colleague with a good memory. An agent that writes can accept an order, change a carrier, quote a price. In forwarding, the expensive decisions are all writes, and most of them are made in minutes, as anyone who has read [the margin is decided in two minutes](https://edriq.com/blog/the-margin-is-decided-in-two-minutes) will recognise. ## Five threats, translated into dispatch The reference design lists five groups of threats. Here is what each looks like in a forwarder’s inbox. **An unauthorised or accidental write.** The agent reads “can you do it for 1,450?” in a thread, takes it as agreed and puts the rate on the load. Nobody decided that price; a sentence in an email did. **Data leaving the company.** Customer names, lanes, rates and delivery addresses are the most valuable list a forwarder owns. An agent that may send email or call any web address can carry them out, through an innocent-looking summary to the wrong recipient as easily as through an attack. **Prompt injection in a carrier’s email.** The email above is the classic case. A message, an attached PDF, even text inside a photographed document can contain instructions aimed at the agent rather than the person: reassign this load, update these bank details, forward the order history. The design notes that some attacks only work when several inputs are combined, such as a harmless email plus a harmless attachment. It is the same pattern as [the load-board carrier nobody checked](https://edriq.com/blog/the-carrier-nobody-checked), just faster. **The agent as the attacker.** An agent with broad connectors can hammer a customer’s portal or a freight exchange until the company’s account is blocked, or wander from the order system into accounting because the credentials allowed it. **A taken-over environment.** If the machine the agent runs on is compromised, every rule written inside it is compromised too. Limits that matter, such as who may change bank details, have to be enforced outside the agent’s environment, in the system it writes to. ## What to do instead: a written list of what it may write alone **May write alone: facts that come with evidence.** A status backed by a driver’s message or a telematics event. A document attached to the load it belongs to. Fields extracted from a delivery note, marked as unconfirmed. A draft reply waiting in a folder. **Needs a person, every time: anything that commits money or trust.** A rate, to the customer or from the carrier. Accepting an order. Choosing or changing a carrier. Any change to a counterparty’s bank details, confirmed on a phone number found independently. Anything sent to a customer that promises a time or a price. **Close the outbound door.** The agent may reach the systems on a short list, and nothing else. New destinations are a decision, not a default. **Keep the credentials out of the agent.** It acts through connectors with their own limits, not with a dispatcher’s password. **Make the dispatcher’s device a window.** The agent runs on infrastructure the company manages, and the laptop or phone shows what it did overnight and what is waiting for a decision. Closing the laptop stops nothing; it also grants nothing. EdrIQ is pre-launch and built on sovereign open source; its order intake is designed on this principle, with the system reading and a person confirming. It is not a tachograph, a SENT or e-TOLL tool, or a customs system, and it claims no integration with the products named above. More on the [EdrIQ homepage](https://edriq.com/). ## A test you can run tomorrow Take yesterday’s inbox and list every action an agent could have taken from it: statuses, documents, rates, assignments, bank details, replies to customers. Put each in one of two columns: “may write alone, with evidence” or “a person decides”. Then find every email in that inbox that asked for a change to a carrier, a load or a bank account, and ask who would have noticed if a machine had simply done it. Anything without an answer belongs in the second column. - AI agents - dispatch - security - carrier vetting ## Keep reading - [The driver runs out of hours 40 km from the dock](https://edriq.com/blog/the-driver-runs-out-of-hours-40-km-from-the-dock) - [The fuel invoice does not know which load burned it](https://edriq.com/blog/the-fuel-invoice-does-not-know-which-load-burned-it)