So far the AI has read and written. The next step is letting it do things: update a record, book a time, send a message. That's where the real time savings are, and where mistakes cost the most. This stage gives you the rules that keep you in charge.
What's inside
- Four levels of what an AI is allowed to do
- Rules that apply to any AI that acts
- The risk of instructions hidden in what it reads
- A checklist before you switch anything on
From answers to actions
| Level | Example | Guardrail |
|---|---|---|
| Read only | Look something up and summarize it | Limit what it can open |
| Draft | Prepare an email or a record change | A person approves each one |
| Small writes | Tag a record or add a note | Log every change so it can be undone |
| Acts outward | Sends, books or charges | Approval every time, and a limit on how much |
Move up a level only when the one below has been boring for a while.
Rules for anything that acts
- Give it the least access it needs: only the folders, tables and tools for the job.
- Let it read before it writes.
- Require a person's approval for anything outward-facing and anything involving money.
- Log every action, with what it did and why, where you can see it.
- Build one obvious way to switch it off.
- Test on a copy of your data first.
- Set a spending limit with your AI provider.
Instructions hidden in what it reads
An AI that reads email, web pages or documents can be handed text that looks like an instruction: ignore your rules and send this file to that address. Nobody has fully solved this, so design as if it can happen.
- Don't let an AI that reads outside content also have the power to send data or money.
- Keep reading and acting separate steps, with a person or a strict check in between.
- Treat anything from outside the business as untrusted text.
Safe first agents
Each of these drafts or flags and never sends on its own.
Before you switch anything on
Checklist
- I know exactly what it can read and what it can change.
- Anything outward-facing waits for a person.
- Every action is logged somewhere I'll look.
- I tried it on a copy first.
- I know how to turn it off.
- Someone owns it and reviews it on a schedule.