OSHA, drawing on NIOSH, ranks the ways to control a hazard from most to least effective:
- Elimination. The hazard no longer exists.
- Substitution. Swap in something less hazardous.
- Engineering controls. Keep people away from the hazard: guards, interlocks, enclosures.
- Administrative controls. Change how work is done: procedures, training, warnings.
- Personal protective equipment. Gloves, glasses, hard hats.
The top works without anyone having to remember anything. The bottom depends on people doing the right thing every time. OSHA notes you often combine them.
For bots
| Level | Factory | Bot |
|---|---|---|
| Elimination | Stop using the hazardous chemical | The bot has no send, delete or payment tool |
| Substitution | Use a less toxic chemical | A drafting tool instead of a sending tool. Read-only instead of edit. |
| Engineering | Machine guard, interlock | Least-privilege access. A person's yes before anything goes out. |
| Administrative | Procedure, training, sign | Rules in the skill. "Never send without approval." |
| PPE | Safety glasses | Reviewing output after the fact and catching errors |
The lesson
Most people manage bots from the bottom. They write a rule: "Don't send emails without asking." That's an administrative control. It works until a long conversation buries it, or an input tells the bot otherwise.
Start from the top instead:
- Does the bot need to send at all? If not, don't connect a send tool. Elimination.
- If it needs to prepare emails, give it drafting only. Substitution.
- If it must send, put a person's yes in the path. Engineering.
- Then write the rule too. Administrative.
- And still read what it made. PPE.
Removing a capability beats writing a rule about it.
An example
A bot keeps your project files tidy. It needs to read and write files.
- Does it need to delete? Probably not. Remove delete. Old versions go to an archive folder instead.
- Does it need the whole drive? No. Give it the project folder only.
- Does it need to share files with outsiders? No. Remove sharing.
Now the worst it can do is misfile something in one folder. That's a small hazard.
Where bots differ
On a factory floor, elimination is often expensive. Redesigning a process costs real money. With bots it's often free: don't connect the tool. That makes the top of the hierarchy easier for bots than for factories.
But software controls can be loose in ways steel isn't. A connector may grant more than its name suggests. Check what access a tool really gives. See Tools and connectors.
Back to Machine safety for bots.