AI in Practice ·
The AI Never Gets the Keys
AI agents are starting to act on the business, not just advise it. The safest ones never hold the keys: they propose, and something else decides.
For most of the last few years, AI has been an assistant. It drafted the email, summarized the report, suggested the code. A person read it, decided, and did the thing.
That is changing. AI agents can now update a record, send a message, raise a ticket, change a setting or move work from one system to another. They don’t just advise the business. They act on it.
That shift is useful. It is also where most of the real risk lives.
An assistant that’s wrong wastes a minute. An agent that’s wrong can send the email.
The question isn’t how smart the AI is
When organizations evaluate agents, the conversation usually centers on capability. How accurate is it? How well does it reason? Can it handle the edge cases?
Those questions matter. But even a very good model will sometimes be wrong, and it will sometimes be wrong confidently. The more useful question is what happens when it is.
That isn’t a question about the model. It’s a question about the system around it.
The AI proposes. Something else decides.
The approach we use rests on one rule: the AI never gets the keys.
It isn’t connected straight to your systems. When it wants to do something, it asks. A separate rule-checker, software that sits between the AI and everything it can touch, looks at the request and does one of three things:
- allows it, because it’s low-risk and within the rules
- holds it for a person to approve
- or stops it
The rule-checker doesn’t get tired, doesn’t get persuaded and doesn’t depend on the AI behaving well. It just knows the limits.
- 01 →The AI proposes
- 02 →Rules are checked
- 03 →A person approves
- 04 →It happens
- 05It’s recorded
Not every action carries the same risk
The limits come from a simple question: how much harm could a mistake do?
1. Low risk: let it help
Drafting a note, summarizing a document, sorting incoming requests. If it’s wrong, someone notices and fixes it. The AI can do this freely.
2. Undoable: let it act within limits
Drafting a customer reply from an approved template, proposing a meeting time, preparing a quote. Mistakes are visible and reversible, so the AI can act inside clear guardrails.
3. Changes a record: ask first
Updating a customer file, opening a ticket, changing a status. The AI can prepare the change, but a person says yes before it happens.
4. Money, law, regulation: never alone
Moving money, giving regulated advice, signing, approving credit. However good the AI looks, a person stays in charge, and the organization’s normal controls apply.
Most organizations should start at the bottom of that list and climb only when the evidence says they can.
A person approves before, not after
“Human in the loop” has become a reassuring phrase. It only means something if the person can still stop the action.
A person reviewing a log of what the AI already did isn’t oversight. It’s an audit. Real approval happens before the action, in a queue that shows the person what the AI wants to do, why, and what evidence it used.
And every action, approved or not, gets written down: what came in, what the AI proposed, who said yes and what changed. If anyone ever asks why something happened, there’s an answer.
Outside content never gets a vote
There’s a less obvious risk worth naming. Agents read things: emails, documents, web pages, attachments. Some of that content can contain instructions written to trick the AI.
A supplier’s PDF could include hidden text telling the AI to update bank details. A web page could tell it to forward a file.
The rule is simple. Content from outside is information, never authority. Nothing the AI reads can approve an action on its behalf. Only the rules, and the people behind them, can do that.
Always keep a way back
Finally, every agent needs an off switch. If something looks wrong, the team should be able to stop it at once and go back to doing the work the old way, without losing anything.
Changes to the AI itself, its instructions, its tools, its model, should be tested and released the way any important software change is. A model that behaved well last month can behave differently after an update.
Trust is earned, not configured
None of this slows AI down for its own sake. It’s what lets an organization give AI more responsibility over time, with confidence, rather than all at once and with crossed fingers.
What may it do on its own?What needs a person’s yes?What may it never do?How would we know if it went wrong?How do we stop it?
If those questions have clear answers, an agent can do a great deal of useful work. If they don’t, it isn’t ready to act, however impressive the demo.
The AI can do the work. It just doesn’t get the keys.