Lesson9 min

Approvals and limits

What may an agent do alone, what does it only prepare, what never? The answer hangs not on gut feeling but on two questions: can the step be undone, and does it affect others?

Boaz Lichtenstein

Part of the path Agents that actstation 6 of 7level 2 Intermediate

The question “how much may the agent do?” is usually answered with a feeling – and the feeling swings between “everything, it is good after all” and “nothing, you never know”. Both are useless. There is a criterion that holds up.

Two questions for every action

Can it be undone? Renaming a file in your own folder: yes. Sending an email: no. Triggering a payment: no.

Does it affect others? A draft stays with you. A message, a published post, a booking reach people who were not asked.

That gives three columns:

Column	Criterion	Examples
Alone	reversible, affects only you	read, search, summarise, drafts, sort
With approval	irreversible or affects others	send, publish, book, change data
Never	high damage, hard to verify	move money, enter credentials, change permissions, delete for good

The third column is not a declaration of distrust. It contains the steps where an approval in passing is not enough, because in a dialog you cannot see what you are confirming.

Technical limit beats instruction

“Send nothing without asking” in the prompt is a wish. A missing permission to send is a fact. The difference shows when something goes wrong: a manipulated web page or email can override an instruction, but not a permission that was never granted.

Hence the order:

Do not grant the permission if the task does not need it.
Scope the permission narrowly: one folder rather than the whole store, one inbox rather than all.
Only then an instruction in the prompt – as a supplement, never as the only safeguard.

An identity of its own for the agent

If the agent works with your account, it may do everything you may. An identity of its own with narrow permissions is better:

a separate user account in the business system, read-only or with few write permissions
a separate browser profile with no saved sign-ins
for purchases a single-use card or a limit rather than the company card

That has a second advantage: in the log you can see what the agent did and what you did.

Approvals somebody reads

Twenty confirmation dialogs a day create not security but a reflex. Good approvals are rare and complete:

Bundled. The agent collects ten drafts, you approve them in one pass.
With all the details. Recipient, amount, full text – not “send email to customer?”.
“Always allow” only for the first column. And with a date on which you go through the list again.

The strongest pattern is draft first: the agent prepares, the human triggers. It works for emails, orders, bookings and publications alike.

Start narrow, widen with evidence

Start every new task one column stricter than you think necessary. Keep a log for two weeks: what did the agent propose, what did you change? If you changed nothing ten times in a row, that is evidence with which you can move an action into the “alone” column – for exactly that workflow, not across the board.

And every widening comes with the opposite direction: a way to stop the agent at once, and someone who knows where that switch is.