How do you decide what your AI agent is NOT allowed to do?
most of the conversation around AI agents is about what they can do. faster, smarter, more autonomous. but i've been thinking about the other side of that question.
when you're building with agents, at some point you have to draw a line. this agent can read but not write. it can suggest but not send. it can book but not pay. somewhere, someone made that call.
but how? was it intuition? a security review? a near miss? a customer asking a very uncomfortable question?
because here's what i keep noticing: most teams haven't actually decided what their agent is not allowed to do.
they've just decided what they built it to do, and assumed that's the same thing. it's not.
an agent operating without explicit limits doesn't mean it's safe. it means nobody has thought about the blast radius yet.
curious how people are actually drawing that line in practice.
is it a technical constraint, a policy decision, or something you figure out after something goes wrong?
Replies
the line I've found actually holds isn't can it be undone, it's who can verify it was the right call in the first place. an agent can send a message that's technically reversible, but by the time a human checks in, the damage already happened. anything touching money or another person's inbox needs a human in the loop no matter how confident the agent is