How a small agency runs AI agents safely: the human yes
Why an agent should propose but never approve, how an approval gate with a single-use code works, and the other rules that make an agent safe to trust with a client.
The fastest way to lose a client with AI is to let an agent change their account on its own. A paused campaign, an edited order or a message sent in the wrong tone takes seconds to do and weeks to repair. The answer is not to keep agents away from real work. It is to build the pause into the system so it cannot be skipped.
Why should an agent not act on its own?
Because the agent that suggests an action should never be the one that signs it off. Agents are fast and confident, and they read text written by other people, some of it written to mislead an assistant. A person in the loop is not a formality. It is the part of the system that knows the client.
What is an approval gate?
One chokepoint that every consequential action passes through. The list of action kinds is closed, so adding a new one is a code change a person reviews. Reading runs freely. Writing has to be armed and approved.
- The agent proposes. It can describe the action. It cannot approve it and cannot run it.
- The gate arms it. It writes, in one plain sentence, exactly what will happen, and issues a single-use code.
- A person approves. Nothing runs until the approval comes back quoting that exact code, so the pause is enforced by the software and not drawn on a screen.
- The decision is recorded. Every yes and every no names who made it.
- A no is remembered. The agent cannot reopen a rejected question by asking it again in different words.
What should never be automatic?
| Kind of action | Rule | Why |
|---|---|---|
| Reading numbers, messages and calls | Free, read-only | Looking cannot change anything |
| Changing a client's account | Proposed, armed, approved | Mistakes reach the client |
| Sending a call's words for summary | Its own approved action | It sends a client's words off the machine |
| Acting on another agent's note | Only with your own person's yes | A note is information, not an order |
How do you keep credentials away from the agent?
Do not rely on telling it not to look. Matching words in a command is not enough, because a path can be assembled in pieces across several harmless-looking steps. Have the operating system refuse the agent's shell access to the credential files outright, however the request is spelled. If that layer is ever missing, the system should say so out loud rather than carry on quietly.
What about instructions hidden in what the agent reads?
Treat everything the agent reads as information, never instruction: a web page, a transcript, an email, a note from another agent. Any of them can carry a line written to an assistant. The approval gate is the backstop. Even if a hidden line talks an agent into proposing something, a person still has to approve it.
What other rules are worth having?
- Partial success is failure. A job that finished most of its work did not finish, and the record should say what failed.
- Filters fail closed. If a safety check cannot run, the answer is no.
- Briefs say what they could not read. A summary built on stale data and presented as current is worse than none.
- No setting switches the gate off. A control that can be disabled will be, on the busiest day of the year.
Does all this slow the team down?
Less than you would think. The agent still does the reading, the preparation and the drafting, which is most of the time. The person spends a moment on the decision that matters. That is the right split: the agent multiplies the team, and the team keeps the judgement it was hired for.
How do we run it?
Exactly this way. Housefly, the system we built to run Drifted, gives most of the team an agent of their own, and every action that would touch a client's live account waits at one gate for a person's yes with a single-use code. There is no setting to turn it off. It is being prepared for a public release.
When is a gate overkill?
When nothing the agent touches can reach a client or cost money: drafting internal notes, tidying files, summarising your own reading. Gate the writes that leave the building, and let the rest run.