What an AI Agent Should Never Do Without Asking

A new office manager does not get the company credit card on day one. They answer the phone, book appointments and learn where things are kept. Over a few months, as you watch them handle the small stuff well, you hand over more. Nobody writes this down.

An AI agent needs the same arrangement, except it has to be written down. The question is not whether an agent can do something. Often it can. The question is which actions it takes on its own, which it prepares for a person to approve, and which it never touches at all.

Three lists, not one switch

Most people picture an agent as either on or off. It works better to sort every action it might take into three lists:

• Do it. The agent acts on its own and records what it did. Looking up an order, filing a document, sending a confirmation, updating a status.
• Draft it. The agent prepares the action and a person approves it with one click. A reply to an upset customer, a quote, a change to a booking with a deposit on it.
• Hand it over. The agent stops, flags it and passes it to a named person with what it found. A legal threat, a medical question, anything it cannot classify.

We introduced the idea in agentic solutions vs. automation. Here is what belongs on each list.

What should always wait for a person

A few kinds of action belong on the draft or hand-over lists almost everywhere.

Moving money. Refunds, credits, discounts, payments to vendors, changes to bank details. An agent can prepare a refund and show its reasoning. A person presses the button, at least until the agent has a long record of getting it right. Requests to change where you send a payment are a favorite trick of fraudsters, so they should never be approved from an email alone, whoever reads it.

Deleting anything. Records, files, accounts, messages. Archiving is usually fine. Destroying has no undo.

Making promises. A delivery date, a price, a warranty decision, a guarantee. Once a customer has it in writing, it is your promise, whoever typed it.

Saying something new in public. Posts, review replies and anything that goes out under the company name for the first time. An agent can draft the reply to a one-star review. A person should read it before the world does.

Anything about a person’s health, legal situation or employment. Medical questions, injury claims, hiring and firing, disputes with staff. These need judgment and a record of who decided. If your business works under rules like HIPAA, the limits are not optional, which we covered in AI and compliance.

Giving access. Creating a login, sharing a folder, adding a vendor to a system. Access is easy to grant and easy to forget.

Stepping outside its own job. If the scheduling agent receives a billing complaint, it should pass it on, not try to solve it.

A test for the gray areas

For anything not on those lists, ask three questions about the action:

1. Can it be undone? Rescheduling can. A sent email cannot.
2. Who sees it? An internal note is low stakes. A message to a customer is not.
3. What does a mistake cost? A wrong tag on a ticket costs a minute. A wrong discount on a large order costs real money and an awkward phone call.

If the action is easy to reverse, stays inside the business and costs little when wrong, let the agent do it. If it fails any of the three, start it on the draft list. Starting cautious costs a few clicks a day. Starting loose can cost a customer.

Make the limits real

Telling an agent to be careful is not a limit. The limits that hold are built into what the agent can reach.

Give it only the access its job needs. An agent that books appointments should not be able to issue refunds, because it has no access to the payment system. Read access where reading is enough, write access only where writing is the job.

Put numbers on it. “Small refunds are fine” means nothing to software. A dollar limit, a daily count or a list of allowed actions does.

Teach it to stop, not guess. When a required detail is missing or a request falls outside its limits, the right behavior is to flag it and hand it over, not fill the gap with its best guess.

Keep a log a person can read. Every action, in plain language, with what the agent saw and why it acted. When something goes wrong, you can find out why.

Have a stop button. Someone on your team should be able to pause the agent right away, without calling anyone.

Move tasks up the list slowly

The lists are where you start, not where you stay. When an agent has drafted the same kind of reply for weeks and a person has approved nearly every one without changes, that task is a candidate to move from draft to do. When a task keeps getting edited or rejected, it stays put, or moves back.

Review the lists once a month with the person who approves the drafts. They will know better than anyone which approvals are a formality and which ones catch real mistakes. Teaching your team to make those calls is part of training your team to work with AI agents.

Before you turn an agent on

• Have you listed every action it can take?
• Is each one marked do it, draft it or hand it over?
• Does each hand-over have a named person?
• Is its access limited to what its job needs?
• Are the money limits written as numbers?
• Can someone read the log and stop the agent today?
• Is there a date on the calendar to review the lists?

How we set it up

Our AI Workforce practice builds agents trained on your workflows with these controls on by default: each agent sandboxed and scoped to the systems its work needs, a permanent log in plain language, and a stop button for one agent or the whole crew. On Wave Workforce, the platform they run on, you decide what runs unattended and what waits for a person, and your own team sets limits and clears exceptions from a console without writing code.

If you are weighing your first agent, book a call and bring the list of things it should never do alone.