The big fear about artificial intelligence is losing control. In practice, most of that control comes down to one line: what a bot can do on its own, and what needs a person's yes.
The line
A simple version that works for most setups:
| Bot does freely | Bot asks first |
|---|---|
| Read, search, research | Send an email or message |
| Draft documents and replies | Post anything public |
| Organize its own files | Spend money |
| Suggest changes | Delete or share files outside its workspace |
| Run checks | Change its own instructions |
The left side is thinking and preparing. The right side is acting in the world in your name.
Why this line
Things on the left can be undone or ignored. A bad draft goes in the trash. Things on the right often can't. A sent email stays sent. A post gets screenshotted. Money moves.
So the yes goes where things become permanent or public.
What counts as a yes
- A clear yes from the right person for that specific action. "Send this to Jim" is a yes for that email.
- Not a general vibe. "Handle my inbox" isn't a yes to send anything.
- Not silence. If the bot asks and you don't answer, the answer is "hold."
- Not another bot. A teammate bot's okay isn't approval.
Trust grows, the line can move
When a new person starts, you check their work closely. Over time, as they prove reliable, you let them handle more on their own.
Bots can follow a similar path. Start with everything on the right side gated. As a bot proves itself on a type of task, you might loosen one specific thing: "you can send the weekly status email to the team without asking." Write that change down. It's a change to the system, and it should be treated like one. See Change on purpose.
Some things should probably stay gated no matter what: money, permissions, deleting records, anything legal.
Safety is a system, not a feeling
People sometimes ask, "Is this bot safe?" A better question: "What can this bot do without asking, and is that okay?"
You answer it with:
- The tools you give it. No send tool, no unapproved sends. See Tools and connectors.
- The rules in its instructions. "Draft by default."
- The records it keeps. So you can see what it did.
- The checks you run. See Verification and evals.
Borrowed from the factory floor
Machine safety has worked on this problem for a century: design the hazard out, guard what's left, and stack the layers. A person's yes is the interlock. See Machine safety for bots and The hierarchy of controls.
A real example
Our Grok Bots draft emails and messages but don't send them on their own. When a message should go out, the owner sees the full draft and approves it. In our review of 90 marketplace templates, at least 22 carried a similar rule: draft by default, nothing sends, spends, posts or deletes without an explicit yes (good-practice.md).
What this means for you
- Draw the line before the bot starts.
- Gate sends, spends, posts and deletes.
- Silence means hold.
- Loosen one thing at a time, in writing.
Nobody hands a new hire the company credit card on day one. The same instinct works for bots.