# What should an AI agent be allowed to promise? **Start by letting it promise nothing it cannot point at, and then open one thing at a time.** The useful question is not *how much autonomy* — it is *which of eight specific things may this agent do*, because each one has a different cost when it goes wrong and a different thing that would make it safe. A single dial from cautious to bold gives you no way to say *yes to quoting a published price, no to agreeing a date*. Those are not degrees of the same decision. They are different decisions, and three of them are not yours to make at all. ## The three it may never do, whatever you decide **These do not open.** Not *not yet* — permanently, and for three unrelated reasons: - **Letting a buyer infer something nobody said.** *We work with several firms in your sector* is true, and a buyer hears *you have done this before*. That is a defect in the sentence rather than a level of risk appetite, so there is no setting where it is acceptable. - **Staking a person.** *You have my word* means nothing from software. There is no person behind it to be let down or to put it right, so the sentence is either empty or a lie. - **Promising a deadline with nothing behind it.** An agent that says *by Friday* without something that makes Friday happen produces exactly the failure that gets agents switched off. You may add a fourth from the list below and keep it closed for good. You may not remove one of these three. ## The five that open, and what opens them | what it may do | what has to exist first | |---|---| | state something with no room for exceptions — *never*, *always*, *every* | a line somebody owns and has checked recently, saying so | | say your side has approved something | a current record of what has actually been approved | | state a figure from one source | that source, named, with an owner and a date | | promise without saying what the promise rests on | the dependency written down somewhere it can read | | send something vague rather than complete or open | nothing you can connect — this one needs the agent to know what it does not know | **Four of the five open by connecting something, not by waiting.** That is the part most people expect to be a probation period and is not: there is no amount of good behaviour that makes it safe for an agent to state a figure it has no current source for. Give it the source and it is safe immediately. **And a source only counts while somebody is still standing behind it.** Each one has an interval and an owner you choose. Past the interval, every permission resting on it switches off — not as a punishment, but because the thing it was relying on went out of date and nobody noticed. ## What is still earned by behaviour Four things, and none of them is on the list above: how much it may send, how many people one mistake can reach, when it has to escalate, and how much of its work a person still reads. The last never reaches zero. ## Why it is written as a list rather than a principle *Don't over-promise* is advice. *May it state a figure from a single source* is a question with a yes or a no, and you can tell afterwards which answer was given. The whole reason for eight settings rather than one judgement is that eight can be explained to a reviewer, and a reviewer is who decides whether your agent runs at all. is why a wording filter does not cover this. is what a reviewer asks for.