Match the agent's freedom to reversibility and impact. Slide from the UNAIR guest lecture, 13 November 2026.
A search tool finds matches. An AI assistant drafts when you prompt it. An AI agent carries out the steps: give it a student's research question and it can search for sources, check the references against catalogue records, summarise why each work matters and draft a reading list for a librarian to approve. This is no longer a thought experiment. In Indonesia, BRI reports that its AI assistant Sabrina served 45% of interactions across its contact channels in 2025; in Malaysia, CelcomDigi reports more than 400 automations across its operations. The question for libraries is not whether agents can help, but which tasks we should hand over first.
What is an agentic library?
An agentic library is a library that delegates reversible work to AI agents under defined permissions, while librarians keep accountability for decisions with lasting effects on people.
The term describes the library as an institution, not a software code library or a product. It also goes beyond "AI in libraries", where an agent is one more tool: in an agentic library, delegation itself is designed, with clear permissions, recovery and an accountable person for each task. And it refers to AI agents, not to the human agency of readers that information science has long studied.
Two ways trust goes wrong
The first is Management Fantasy: "buy the agent and let it handle reading lists", as if the platform could decide what a useful list is, which checks are required and who answers for errors. Those are leadership decisions. The second is Officer Delusion: treating a fluent, well-formatted reading list as verified evidence. Language models can produce convincing citations that do not exist. Together, the two traps send unchecked advice to students at machine speed. The remedy is to define the service first (the decision, the question, the data and the method) and choose the agent last.
The test: can we undo it?
Information systems research already treats work with agents as delegation (Baird and Maruping, 2021). A simple rule decides what to delegate: if a task is reversible, it can be delegated to an agent. Pencil work goes to the agent; ink stays with us. Drafting a reading list or suggesting subject tags is easy to undo, so an agent can prepare it. Batch metadata edits are higher impact but recoverable with version history, so the agent can act while staff monitor and roll back. Sending a reply to a student, sharing patron data or publishing to the repository is hard to undo, so a person approves first.
Judge reversibility from the affected person's side. The library can correct a wrong reference in its saved list, but the student who already spent an afternoon looking for it cannot get that time back.
Security makes more things reversible
Seen this way, cybersecurity is what lets us delegate more. Tested backups restore catalogue data, version control rolls back a bad change, audit trails show which agent changed a record and when, and least privilege keeps the damage small: give an agent a reader's card, and keep the master keys. Recovery must be tested before we depend on automation. After the 2023 ransomware attack on the British Library, its main catalogue took about 11 weeks to return, and only in read-only form.
Agents also bring a new attack surface. A PDF can hide instructions that try to misdirect the agent reading it, for example asking it to send borrower records outside. Treat documents as sources, never as commands, and keep permissions under library control.
Privacy is the hard boundary
Some things cannot be undone. Restoring a system cannot recall a leaked reader record, as the Internet Archive breach disclosed in October 2024, with 31 million user accounts exposed, showed. Access to identities and reading histories stays with people who are accountable for it.
Libraries as trust anchors
As content becomes easier to generate, knowing where it came from matters more. Libraries already help readers check origin, authenticity and version, and they maintain the metadata that people and agents depend on. In an agentic library, agents prepare the reading list; librarians verify evidence, supervise delegation and protect readers.
The way to start is small: one task, one owner, one recovery test and one source check. Which task would you delegate first?
This article is based on Prof. Badrul's closing lecture at Universitas Airlangga. The full slides, with sources, are in the CSNET Library.
Sources
- BRI. Annual Report 2025, p. 240. ir-bri.com
- CelcomDigi (19 August 2026). CelcomDigi launches agentic AI for small and medium enterprises. corporate.celcomdigi.com
- British Library (8 March 2024). Learning Lessons from the Cyber-Attack: British Library Cyber Incident Review. bl.uk
- Have I Been Pwned. Internet Archive data breach (added 9 October 2024). haveibeenpwned.com
- Baird, A., & Maruping, L. M. (2021). The next generation of research on IS use: A theoretical framework of delegation to and from agentic IS artifacts. MIS Quarterly, 45(1). doi.org/10.25300/MISQ/2021/15882
Cite as: Anuar, N. B. (2026, 13 November). The Agentic Library: Delegate What You Can Undo. CSNET, Universiti Malaya. https://csnet.um.edu.my/news/2026nov13-agentic-library-reversibility.html