What an agent should not be allowed to do

The interesting engineering in an agent is not the model. It is the boundary.

Once software chooses its own next step, its mistakes stop being sentences and start being actions. A chatbot that gets something wrong has produced a bad paragraph. An agent that can send email has sent the wrong email, to two hundred people, from your domain, and there is no recalling it.

So the useful question about any product that works unattended is not how clever it is. It is: what is it not allowed to do, and what enforces that?

A prompt is not a control

The most common answer to "what stops it doing something bad" is a sentence in a system prompt asking it to be careful. That is a preference, not a control. The model can misread it, and when it does there is nothing in the way.

Real controls are structural, and there are only a few kinds:

Not having the tool at all. The strongest guarantee about an action is that no code path exists for it. An agent that cannot delete a customer record will not delete one, regardless of what it concludes.

Limits enforced in code. A daily cap that lives in a prompt is a suggestion. A daily cap checked before every send is a fact. The distinction sounds pedantic right up to the first time a run decides it has a good reason to exceed it.

Approval on the actions that matter. Not everything, but the specific set below that spends money, reaches an audience, or cannot be undone.

A log with reasons. Not for compliance theatre. Because the only way to trust unattended work is to be able to check it afterwards, and "what did it do" is a much weaker question than "why did it do that".

Where the checkpoints go

The instinct is to review everything. That does not work, and it fails in a way that is worse than it looks: the bottleneck moves to the review queue, the queue gets long, and by Friday you are approving without reading. Now you have the appearance of oversight and none of the substance, which is more dangerous than having no checkpoint at all, because you have stopped expecting to be surprised.

The opposite instinct, reviewing nothing, means finding out about a mistake after it has been repeated two hundred times.

The rule that actually holds is to place checkpoints by reversibility, not by importance. An important decision you can undo tomorrow is safer to automate than a trivial one you cannot.

In practice that means research, drafting and internal work run alone. Publishing, sending at volume, and spending wait for a person. The second category is deliberately small, which is what keeps the review load survivable and therefore keeps the reviews real.

What this looks like when it is done properly

Some concrete examples, because the principle is easy to agree with and easy to not implement.

A video ad gets written, cast, rendered and built into a campaign, then left paused. Everything expensive is done; starting it is a deliberate human act. The agent did the work and did not take the risk.

Outreach sends inside a daily cap the agent cannot exceed, from a domain with warmup, suppression lists and unsubscribe handling enforced in code rather than requested of the model. A bounce and complaint circuit breaker stops sending automatically, because a sender reputation falls in days and recovers over weeks, and by the time a person notices the problem in a dashboard the damage is already done.

Anything that changes the plan or spends money arrives as a decision with the reasoning attached, so the answer is a judgement rather than a guess.

And every action is logged with why, so a wrong one can be found and understood instead of just noticed.

Be sceptical of "fully autonomous"

Treat any claim of full autonomy as marketing. Reviews of AI SDRs across the category, including the ones sold at enterprise prices, consistently report that teams still spend hours weekly keeping messaging on brand. That is not a failure of those products. It is what the work is.

The honest version of the pitch is not that nobody is needed. It is that the everyday production work happens without you, the small set of consequential calls comes to you, and you can check the rest afterwards because it wrote down what it did and why.

Anyone telling you the number of decisions you have to make is zero is describing a product that has not met a real customer yet.