Field notes · October 12, 2026
What should an AI agent never do without a person's approval?
Five things wait for a person: releasing anything to production, spending money or committing to a vendor, opening a new public channel, setting pricing or anything legal, and changing the rules the agents run under. Two more are off limits even with approval: no agent handles the value of a password or key, and no agent touches live customer or payment records. Everything else, such as research, drafting, building and testing on a staging copy, agents do on their own.
Why these five
Each one is a decision that either reaches your customers, spends your money, or speaks in your name. An agent can prepare all of them. It cannot be the one that says yes.
- Production releases. An agent builds the change and puts it on a staging copy. A person clicks through it there and approves the release. Your customers never see a change no one has looked at.
- Spending and vendors. No charge, subscription or vendor sign-up is made by software on its own.
- New public channels. A new social account, mailing list or outbound channel does not open under your name until a person says so.
- Pricing and legal. Your prices and your obligations stay your call. A person also decides which kinds of content may publish on their own, behind automatic checks.
- The rules themselves. The limits the agents run under stay set until a person changes them. An agent may propose a change; it may not make one.
The two lines approval does not unlock
Credential values. Keys live in one store and are named by the job they do. An agent asks for a key by that job name, and the value goes straight into the process that needs it. It never appears in a message, a report or a transcript, because a chat log cannot be taken back once someone has read it.
Live customer and payment records. The tool that releases staging to production moves pages, content, menus and theme settings. It does not read or write customer accounts, bookings or payment references. That is true no matter who approves the release.
Why the gate sits in the tool, not in the instructions
"Never touch production data" only works if the agent reads it, remembers it and agrees that this case counts. A release tool that cannot reach production data does not depend on any of that. We write each rule down for the agents, and we also build it into the tool they would have to use to break it. When an agent is wrong about what it is allowed to do, the tool refuses, and the agent reports the refusal instead of finding a way around it.
What agents do without asking
The list of things that need a person is short on purpose. Agents read code, documents and public sources; write briefs; write code on a branch and build it on staging; test on staging; and propose new work. That is where most of the hours go, so that is where agents save you the most time. A person's time goes to the decisions.
What this means for you
If you are handing work to AI agents, start by writing down your own five. Ask of every action: does it reach a customer, spend money, or speak in my name? If yes, a person approves it. Then put that rule into the tool, not only into the prompt. You keep the decisions that carry your money and your name, and the agents take the preparation work.