Can you undo it? The one question before letting AI act.
Approving everything burns you out. Approving nothing is reckless. Here's a simple way to decide how much freedom an AI agent gets.
The most common question I get about AI agents is some version of "but how do I trust it?". People imagine two options: approve every single action, or let it loose and hope. The first drives you mad within a day. The second is how you end up with an embarrassing email sent to a client.
There's a much simpler way to think about it. Before deciding whether an AI should be allowed to do something on its own, ask one question: if it gets this wrong, can I undo it?
Three kinds of action
Almost everything an agent does falls into one of three buckets.
- Looking and drafting. Reading files, searching the web, writing a draft, running a test. Nothing changes that you'd care about. If it's wrong, you throw it away.
- Changing things inside your company. Editing a shared document, reorganising files, updating a task. It matters, but you can see what changed and put it back.
- Reaching the outside world. Sending an email, paying someone, publishing a page, posting to social media, signing up for a service. Once it's out, it's out.
Looking and drafting: let it run
Asking permission for an agent to read a file or draft a paragraph is like asking an employee to request approval before opening a document. It's pure friction. Worse, all those pointless approvals train you to click yes without reading, which is exactly the habit that bites you later on the approvals that matter.
Let this stuff happen freely, and judge the result.
Changes inside the company: act, then tell
For reversible changes inside your company, the best pattern isn't "ask first". It's "do it, tell me, and let me undo it". You find out what changed, you can see the before and after, and one click puts it back if it's wrong.
This keeps the work moving without leaving you in the dark. It's also how good colleagues work: they don't ask before fixing a typo in the shared doc, but they don't hide it either.
The outside world: hard limits and your yes
This is where you want real care, because you can't take an email back. A few things help:
- Ask the first time, with the real draft. The first time an agent wants to email a new person or use a new paid tool, show you exactly what it's about to send, not a description of it.
- Approve the who, not every message. Once you've approved a contact or a payee, routine follow-ups within agreed limits don't need you every time.
- Limits that live outside the AI. Spending caps, approved payees and permissions should be enforced by the system, not by asking the model nicely. A model can explain why it wants more freedom. It shouldn't be able to give itself more.
- One big off switch. A single control that pauses every outside action, for when something feels off.
- A record of what went out. What was sent or paid, to whom, when and who approved it.
A starter setup for a small business
If you're just starting out with agents, here's where I'd set the dial and loosen it over time as trust builds:
- Research, drafts, analysis and internal documents: on its own.
- Edits to shared company documents: act, then tell, with undo.
- Emails to people you've already approved: on its own, within a clear mandate.
- Emails to anyone new: ask first, showing the draft.
- Any payment: ask first, with a monthly cap enforced by the system.
- Publishing anything public: always ask.
Trust is earned, not configured
You don't have to get the settings perfect on day one. Start tight on the outside world and loose on everything reversible. Watch what the agent actually does for a while. Then loosen the parts that have earned it.
It's exactly how you'd treat a new hire. Nobody gives a new starter the company card on their first morning, and nobody makes them ask before opening the shared drive either.