What an Agent Does Alone, What It Asks, and What It Never Does

The first question an owner asks about an agent is rarely "how smart is it?". It is "what can it do without asking me?".

That question deserves a written answer. Every agent we build works inside three lists, agreed with the people who own the process before the agent touches anything real.

The three lists

Does alone

Actions the agent takes without asking: answering a routine request, sending a follow-up, reconciling a payment that matches. These are frequent, low-risk, and easy to undo.

Asks you

Actions the agent prepares but does not take until a person approves: a large payment, a discount, an exception to a rule. The agent does the work up to the decision and then waits.

Never does

Actions no agent takes, whatever the instruction: signing a contract, changing bank details, deleting records. These are not "ask first" items. They are outside the agent's reach.

How to write them

Start from actions, not intentions

"Be careful with money" is not a limit. "Payments over EUR 5,000 need approval" is. Each line in a list names an action in a system and, where it applies, a threshold.

Sort by two questions

For each action, ask what the worst outcome costs and whether it can be undone. Cheap and reversible goes in the first list. Expensive or hard to reverse goes in the second. Anything that would be unacceptable even once goes in the third.

Enforce them in code

A list written only in the prompt is a request. The model usually follows it, and "usually" is not a control.

The limits are checked by deterministic code between the agent and the system: the agent proposes an action, the check allows it, routes it for approval, or blocks it. For the third list, the simplest enforcement is the strongest one: the agent is not given the tool at all.

Approvals that do not become a bottleneck

If every approval takes a day, people will ask for the agent to be switched off or for the limits to be removed. Neither is the result you want.

A good approval request has four parts:

• What the agent wants to do, in one sentence.
• Why, with the data it used.
• What happens if it is approved, and if it is not.
• One action to approve or reject, where the person already works.

The person should be able to decide in under a minute without opening another system. If they cannot, the request is missing something.

Every action is logged

All three lists produce a record: what was done alone, what was asked and who answered, and what was blocked. That log does three jobs.

It explains any single result when someone asks. It shows patterns, such as a kind of approval that is granted every single time. And it is the evidence for changing the lists.

When a list is allowed to grow

The lists are not fixed. They start narrow and widen on evidence.

If the log shows that discounts under 5% have been approved without changes for months, that action can move from "asks you" to "does alone". The person who owns the process makes that call, with the data in front of them.

It works in the other direction too. If quality drops after a model or tool changes, the action moves back to approval until the numbers recover.

This is how a process climbs the five levels of company autonomy: not by a decision to trust the agent more, but by a record that shows it has earned it.

You stay the pilot

More autonomy does not mean less control. The lists, the checks, and the log are what make it reasonable to let an agent work alone at all.

If you want to draft these lists for one of your processes, book a call.