Answer
What should you never let an AI agent do without permission?
Anything irreversible, anything a third party sees, anything that spends money, and anything that deletes evidence.
Four things: anything irreversible, anything a third party will see, anything that spends money, and anything that destroys the record of what happened. Everything else can be autonomous inside a boundary you can describe in one sentence.
Permission policies fail when they are written as judgements about how risky an action feels. Feelings about risk move with deadline pressure, and the policy quietly loosens exactly when it is most needed. A policy written against structural properties of the action does not move, because the properties do not.
The first category is irreversibility. Deleting, overwriting, force-pushing, dropping, terminating, migrating. The test is not whether the action is dangerous but whether there is a path back, and the honest answer usually depends on whether a backup exists that someone has restored from recently. Where the path back is theoretical, treat the action as irreversible.
The second is audience. Anything a customer, supplier, regulator or public reader will see should pass a person, because the error you cannot take back is not the file, it is the impression. This is the category most often waived on grounds of volume — the whole point of the system was to send the messages — and the correct resolution is usually to let the agent prepare a batch and have a person release the batch, which preserves nearly all the time saving and none of the exposure.
The third is money: purchases, refunds, plan changes, resource provisioning, anything metered. Two failure shapes matter here. One is the obvious wrong transaction. The other is the loop that costs a great deal by repeating something cheap, which no permission prompt catches because each individual action is trivially small. That one needs a budget cap rather than a confirmation, and the two controls are not substitutes.
The fourth is the record. An agent should never be able to edit or delete its own logs, the audit trail, the version history, or the monitoring that would show what it did. This sounds like a precaution against bad intent and is really a precaution against ordinary tidying: an agent asked to clean up a directory will clean up the directory, and the run log lives in a directory.
Against those four, the actions that can safely be autonomous are large in number and dull in character: reading, searching, drafting into a scratch location, running tests, producing analyses, and writing anywhere that is versioned and reverted with one command. A boundary drawn this way is also explainable to a non-technical owner in a sentence, which matters more than it sounds, because a permission policy nobody in the business can restate is a policy that will be worked around within a fortnight.
One thing this framework deliberately does not do is grant permanent exemptions on the basis of good behaviour. A system that has run correctly for months has demonstrated reliability on the inputs it happened to see. Widening its boundary should follow from a change in the evidence — a check that now runs, a rollback that now works — rather than from accumulated goodwill.
Draw the permission line at reversibility, not at risk appetite; risk appetite drifts on a busy day and reversibility does not.
Siddharth Sharma, Context Theory
Related questions
Does asking for permission on everything defeat the purpose?
It would, which is why the four categories are narrow and everything outside them is autonomous by default. The common mistake is the opposite of over-asking: a confirmation prompt on every file write trains the operator to approve without reading, and an approval given without reading is worse than no approval because it creates a record suggesting review happened.
How should permission work when nobody is watching overnight?
Queue rather than block. The agent completes everything inside its boundary, prepares the actions that require permission with enough context to decide, and stops. The morning review is then a short list of decisions rather than an investigation, and the alternative — granting overnight autonomy because nobody is available — is how the boundary gets widened for a reason that has nothing to do with the work.
METHOD
Every figure below carries its source and the date it was verified. Nothing on this page is asserted.
The numbers on this page.
| What | Value | Specific to |
|---|---|---|
| Firms that never responded to a web enquiry at all | 23% | Category-wide |
| Sub-15-minute compliance — automated routing vs manual only | 62.5% vs 39.1% | Category-wide |
Oldroyd, McElheran & Elkington, "The Short Life of Online Sales Leads", Harvard Business Review (March 2011) · 1.25M inbound leads across 2,241 US firms · verified
2026 speed-to-lead benchmark · verified
What is specific to this page.
| Kind | Claim | Check it against |
|---|---|---|
| Constraint | A permission boundary drawn on structural properties of an action — reversibility, audience, expenditure, and effect on the record — holds under deadline pressure, whereas one drawn on perceived risk loosens precisely when the pressure that makes it necessary is highest. | Reviewing which permission rules were waived during the last incident or deadline in any team that operates one. |
| Software | A confirmation prompt cannot catch the failure where an agent spends heavily by repeating an individually trivial action, so a spend cap and an approval prompt are complementary controls rather than substitutes for one another. | The billing record of any agent run that entered a retry loop, compared against the approval log for the same run. |
| Workflow | Preventing an agent from modifying its own logs, audit trail or version history guards mainly against ordinary tidying rather than against intent, because an agent instructed to clean a directory will act on whatever the directory contains. | Checking whether the agent's working directory contains its own run log, and whether the log path is writable by the agent's tools. |
| Buying behaviour | Batch preparation with human release preserves most of the time saving on high-volume outbound work while keeping every externally visible artefact behind one human decision, which is the resolution for the audience category that volume pressure otherwise waives. | Timing a run where the agent prepares a batch for release against one where each item is individually approved. |
Each row would be wrong on another industry's page. Where a sourced figure exists it is in the table above instead; these are the constraints that shape the work and do not happen to be numbers.
Start with the measurement.
Reading about a benchmark is not the same as knowing your own number. The audit produces yours, measured rather than estimated.
$497 · delivered in 5 business days · credited against month one