What an AI agent shouldn't do on its own

You don't make an AI agent get approval for every move, or it stops being useful. But a few actions should never go ahead without your OK. Here they are, and why.

The question to ask

One question sorts out almost everything: if the agent gets it wrong, can it be undone?

Renaming a file, writing a draft, looking something up, putting together a spreadsheet: if it goes wrong, you start over. Paying someone, emailing a customer, emptying a table: once it's done, it's done. That's where the agent should stop and ask you.

Six kinds of actions that need approval

• Paying. An invoice, a subscription, an order, a bank transfer. Before the money leaves, you want to see the amount and the recipient. Even a careful agent can mix up two invoices or pay the same one twice.
• Sending in your name. An email, a message, a letter. What's sent gets read, and can't be taken back. The tone, the recipient, an attachment that's missing or shouldn't be there: better to see it first.
• Deleting. Files, rows in a database, an account, a branch. Even with a backup, restoring takes time. And a backup you've never tested isn't really a backup.
• Publishing. An article, a post, a production deploy. Whatever goes public gets seen, copied, sometimes archived, before you even take it down.
• Committing. Signing up for a service, accepting terms, booking, signing. The agent puts your name on the line, and sometimes your money.
• Choosing for you. Between two quotes, three time slots, four headlines. It's not irreversible, but it's your taste and your judgment. The agent can prepare the choice and lay it out for you.

What you can let it do

Pretty much everything else. Reading, searching, summarizing, sorting, drafting, suggesting. The more you let the agent work alone on what can be undone, the more weight its questions carry. That's what keeps you from answering “yes” without reading.

A good test: if you get more than a few requests a day for the same task, the line is probably set too low. If you find out afterwards about actions you would have wanted to see, it's set too high.

An instruction ready to copy

Most agents (Claude, ChatGPT, Claude Code, Cursor) accept standing instructions. Something like this is enough to start with:

Before paying, sending a message on my behalf, deleting, publishing or signing up for anything, ask me with the ask_human tool. Put the amount, the recipient or the text in the context, and offer clear answers. If I don't answer before the deadline, don't do it.

The ask_human tool comes from Aval: the question reaches your phone with one button per answer, and the agent waits. The guide Adding human approval to an MCP agent explains how to connect it.

Two non-negotiable rules

• Silence is not a yes. If you don't answer, the agent does nothing. A question that expires counts as a no.
• The agent doesn't answer for you. It asks the question, but it must have no way of answering it itself. With Aval, the answer link only goes through your email or your phone; the agent never sees it.

Frequently asked questions