In a plant, finished product doesn't just roll out the dock door. Someone with the authority releases it. Until then, it waits. If something's wrong with it, it goes to a hold area, tagged, so nobody ships it by mistake.
That's one of the most useful ideas to carry over to bots.
Release and hold in ISO
ISO covers this in two clauses:
- Release: product and services aren't released until the planned checks are done and someone authorized says so.
- Nonconforming output: output that doesn't meet requirements is identified and controlled, so it isn't used or delivered by accident.
The bot version
For bots, "shipping" is anything that leaves your control:
| Ships (needs a yes) | Doesn't ship (bot can do freely) |
|---|---|
| Sending an email or message | Writing a draft |
| Posting publicly | Saving a file in its workspace |
| Spending money | Researching |
| Deleting or sharing outside its workspace | Suggesting a change |
So the rule is: draft by default. The bot prepares. A person releases.
Silence means hold
Here's a detail that matters. If the bot asks "should I send this?" and nobody answers, what then?
In a plant, untagged product doesn't ship. Same here. No answer means hold. The bot doesn't decide that silence is a yes.
Another bot's yes isn't a yes
If you run a team of bots, one bot might check another's work. That's useful. But a teammate bot saying "looks good" is a review, not a release. Release comes from a person with authority. See Multi-bot teams.
What a good yes looks like
- Specific. "Send this draft to Jim" approves that draft, to Jim.
- Seen. The person saw the actual thing: the recipients, the subject, the text.
- Recorded. The yes is noted, so it's clear later who approved what. See Write it down or it didn't happen.
A general "handle my email" isn't a yes to send anything.
A real example
Our Grok Bots draft emails and messages, and the owner approves before anything goes out. On this site, pages go into an "approved" folder only after the owner says yes, and only that folder gets published. In our review of 90 marketplace templates, at least 22 carried some version of "nothing sends, spends, posts or deletes without an explicit yes" (good-practice.md).
Does this slow things down?
A little, and on purpose. Drafts are instant. The yes takes a moment. Over time, as a bot proves itself on one kind of task, you can loosen that one thing, in writing. See Human approval and safety.
What this means for you
- Draft by default.
- A person releases anything that ships.
- Silence means hold.
- Write down who said yes.
The gate isn't distrust. It's how every good plant ships.