What should an AI agent never be allowed to do on its own?

Every serious conversation we have with a business owner arrives at the same question within ten minutes. Not "can it do this?" but "what if it gets it wrong, and it has already sent the message?"

Capability is the easy half

Getting a model to draft a good reply, plan a campaign or produce an invoice is largely a solved problem now. Getting a system you would let do those things unsupervised, on your accounts, with your customers, is not. The gap between the two is entirely about controls.

The mistake is to treat this as a quality problem — as though a sufficiently good model would eventually not need guardrails. It will still need them, for the same reason a competent employee still needs a spending limit. Authority and ability are different things.

Our answer: classify, check, log, and gate

Before an action runs — sending a message, spending on ads, issuing an invoice, writing to a connected system — it goes through a gate that does four things in order:

• Classifies the risk of the action. Drafting is not the same as sending; sending is not the same as spending.
• Checks it against your workspace policy: the autonomy level you set for that action type, and your spend caps.
• Writes it to an append-only audit log — who asked, what ran, what it cost — that the system itself cannot go back and edit.
• Holds it for your approval when the policy says so, rather than running it and telling you afterwards.

The caps are enforced in code, not documented as guidance. An agent can propose a campaign above your budget. It cannot execute one. That distinction is the whole product, really.

Why "quote before you run" matters more than it sounds

Expensive work gets priced before it happens, and the price comes back to you as a number you can say no to. This is unglamorous and it is the single feature that changes how people use the system: it converts an open-ended "the AI is doing things with my money" anxiety into a series of small, legible decisions.

Faith is not a control system.

Start closed, open with evidence

On day one, sensible defaults mean almost everything asks first. That is deliberately a bit annoying. What it buys you is a few weeks of watching the thing work, with a log you can read, before you decide what to let it do unsupervised. Trust granted that way is durable; trust granted at signup is just optimism.

The other half of that bargain is that the system has to be honest when it fails. An agent that says "I could not do this, and here is what stopped it" is far more useful than one that produces a plausible-looking result. We would rather it escalate too often than invent an answer once.