What Should an AI Agent Be Allowed to Do on Its Own?

An AI agent should act on its own when a mistake is easy to detect and reverse. It should ask when the action affects another person, money, public information, or an important record. Some access should remain unavailable altogether.

That is the foundation of a simple boundary system: act, ask, or never.

Act: low-risk and reversible

The agent can proceed automatically when the action is routine, bounded, observable, and inexpensive to undo.

Examples include researching public sources, organizing a private draft, comparing this week's data with last week's, preparing an agenda, or sending a scheduled internal brief to a predefined destination.

“Act” still needs limits. Define which sources are trusted, which folder can change, how often a job runs, and what result should be logged.

Ask: consequential or ambiguous

Require approval when the agent crosses a meaningful boundary.

Common approval points include:

• Sending a message to a client, prospect, or public channel.
• Publishing or deploying something visible outside the team.
• Making a purchase or changing a paid subscription.
• Editing a customer record, contract, or financial document.
• Deleting information or replacing a source of truth.
• Acting when the request is ambiguous or the evidence conflicts.

Approval should be specific. “Do you approve?” is weaker than showing the exact draft, destination, amount, and consequence. The reviewer should understand what will happen with one glance.

Never: outside the agent's role

Some actions should not be available to the agent, even with a conversational request. Examples might include unrestricted access to a personal password vault, moving money above a defined threshold, disabling security controls, or deleting backups.

The exact list depends on the person and business. The principle is stable: if the agent does not need a capability to perform its job, do not connect it.

OpenClaw's official tool overview describes layered policy that can restrict what tools an agent sees based on profiles, channel permissions, provider rules, and sandbox state. Hermes likewise documents security and configurable toolsets. Product controls matter because a prompt saying “be careful” is not the same as enforced access boundaries.

Score the action, not the entire agent

Avoid labeling an agent simply “autonomous” or “human-in-the-loop.” One workflow can contain all three boundary types.

For a prospecting workflow, the agent might act while researching public companies, ask before sending any outreach, and never access a private personal inbox. For meeting operations, it might act while assembling an agenda, ask before moving an executive meeting, and never invite an external participant.

Classify each action using four questions:

1. Impact: What happens if this is wrong?
2. Reversibility: Can it be undone cleanly?
3. Visibility: Will someone know it happened?
4. Scope: Is access limited to what this job requires?

Higher impact, lower reversibility, poor visibility, or broad access should push the action toward “ask” or “never.”

Make approvals part of the design

Do not bolt approvals onto a finished automation. Map them when the workflow is first defined. Decide what evidence the agent must show, who can approve, how long it should wait, and what happens after a rejection or timeout.

This is part of the setup process at MyAgnts. We begin with the job, identify its access needs, and mark consequential moments before the agent runs. See the complete setup and operating process.

A trustworthy agent is not passive. It is confidently active inside well-designed boundaries.