What should an AI agent be allowed to promise?
Last updated
Start by letting it promise nothing it cannot point at, and then open one thing at a time. The useful question is not how much autonomy — it is which of eight specific things may this agent do, because each one has a different cost when it goes wrong and a different thing that would make it safe.
A single dial from cautious to bold gives you no way to say yes to quoting a published price, no to agreeing a date. Those are not degrees of the same decision. They are different decisions, and three of them are not yours to make at all.
The three it may never do, whatever you decide
These do not open. Not not yet — permanently, and for three unrelated reasons:
- Letting a buyer infer something nobody said. We work with several firms in your sector is true, and a buyer hears you have done this before. That is a defect in the sentence rather than a level of risk appetite, so there is no setting where it is acceptable.
- Staking a person. You have my word means nothing from software. There is no person behind it to be let down or to put it right, so the sentence is either empty or a lie.
- Promising a deadline with nothing behind it. An agent that says by Friday without something that makes Friday happen produces exactly the failure that gets agents switched off.
You may add a fourth from the list below and keep it closed for good. You may not remove one of these three.
The five that open, and what opens them
| what it may do | what has to exist first |
| state something with no room for exceptions — never, always, every | a line somebody owns and has checked recently, saying so |
| say your side has approved something | a current record of what has actually been approved |
| state a figure from one source | that source, named, with an owner and a date |
| promise without saying what the promise rests on | the dependency written down somewhere it can read |
| send something vague rather than complete or open | nothing you can connect — this one needs the agent to know what it does not know |
Four of the five open by connecting something, not by waiting. That is the part most people expect to be a probation period and is not: there is no amount of good behaviour that makes it safe for an agent to state a figure it has no current source for. Give it the source and it is safe immediately.
And a source only counts while somebody is still standing behind it. Each one has an interval and an owner you choose. Past the interval, every permission resting on it switches off — not as a punishment, but because the thing it was relying on went out of date and nobody noticed.
What is still earned by behaviour
Four things, and none of them is on the list above: how much it may send, how many people one mistake can reach, when it has to escalate, and how much of its work a person still reads. The last never reaches zero.
Why it is written as a list rather than a principle
Don't over-promise is advice. May it state a figure from a single source is a question with a yes or a no, and you can tell afterwards which answer was given. The whole reason for eight settings rather than one judgement is that eight can be explained to a reviewer, and a reviewer is who decides whether your agent runs at all.
/ai-agent-guardrails-for-sales.md is why a wording filter does not cover this. /get-an-ai-agent-approved-by-legal.md is what a reviewer asks for.