A warning is not a control
A model can explain that it may be wrong and still press the wrong button. Disclaimers set expectations; they do not limit behavior. Once software can send, spend, merge, or delete, the boundary has to live in the runtime around the model.
For sensitive actions, the system should stop. It should show what it intends to do, what will change, and which identity or connection it will use. A person then approves or declines from the place where the work is being discussed.
Permission follows the person
A shared agent should not inherit one ambient set of credentials for an entire company. Connections need to remain scoped to the person who granted them, and the requested action needs to stay attached to the person who asked.
That makes the boundary understandable. The agent can only reach the tools and data the requester is allowed to use, and access can be revoked without changing how everyone else works.
Design for a safe no
A good approval step is not friction for its own sake. It gives the reviewer enough context to make a quick decision and makes declining a normal outcome. Nothing should quietly retry a sensitive action after the answer is no.
The goal is not to make an agent timid. It is to let it move quickly through reversible work and stop cleanly at the edge of authority.
One line to keep
“Autonomy should expand with reversibility, while authority stays explicit.”
Published August 21, 2026
Back to the blog