Last week I opened my notes folder and found a document titled DRAFT-PENDING-RATIFICATION. It was an internal prep doc, a rough outline my AI agent had written to get its own thinking in order. Nobody outside my machines would ever see it. There was nothing to ratify. The agent was waiting on my approval anyway.
That doc was the moment I realized a rule I was proud of had gone wrong.
The rule that worked too well
I run a few AI agents with real authority. They can draft documents, edit code, and write notes in my vault. Some of them can also reach the outside world: send email from my account, post to social media, fire off a text message. So I wrote one hard rule, in plain language, at the top of their instructions: never push an outbound external communication without my explicit approval first.
The rule did its job. Nothing went out the door unapproved. I still think it is the right rule, and I wrote about the other side of this in silence is not approval, where an agent treated a reviewer’s silence as a green light. This post is about the opposite failure: an agent that refused to treat its own green lights as green.
Because the asking did not stop at the send button. It spread.
What the spread looked like
A read-only check, the kind that only reads files and changes nothing, sat undone with a note next to it: “say the word and I’ll run it.” Internal drafts picked up status labels that implied I needed to sign off before the agent could keep working on its own scratchpad. Small, reversible, private actions queued up behind a permission that was never required for them.
My first instinct was to just answer faster. Clear the queue, unblock the agent, keep things moving.
That treats me as the fix, and it is wrong. Every permission request is an interrupt, and every interrupt costs me a decision. If the agent asks about everything, I have not delegated anything. I have just moved the work from doing to approving. The bottleneck was not my reply speed. It was the rule.
Why the rule grew
Look at the rule from the agent’s seat and the creep is obvious in hindsight. I wrote a hard gate against one class of action: external, irreversible sends. I never wrote down where the gate stops. For the agent, asking is always the safe move. Nobody ever got burned by asking permission. So a caution aimed at the outside world quietly expanded to cover the inside one, and every ambiguous case landed on the asking side.
I have started calling this permission creep: a hard gate, written for good reasons, that grows past its boundary because nothing in the rule says where the boundary is.
The fix is not to scold the agent for being careful. Careful is what I asked for. The fix is to write the boundary into the rule.
The fix: a gate with two tests
The rule now has a paired second half. The gate applies only when both of these are true:
- Externally observable. Someone outside my own systems can see the action. An email in someone’s inbox qualifies. A draft in my notes folder does not.
- Materially irreversible. Once it happens, I cannot cleanly undo it. A sent message is irreversible. An internal file edit is not, because the agent can just change it back.
Both true: stop and ask me. Either one false: do the work, and accept that we roll it back if I disagree.
I also added the explicit not-gated list, because “use your judgment” is how the creep started. Internal drafts, read-only checks, reversible edits to my own files: act, then report. No permission required.
The smell to watch for
The tell is a specific sentence shape: “say the word and I’ll X,” attached to work that is private and reversible. That phrasing sounds polite. What it actually does is hand me a decision the agent was supposed to own. When I see it now, I do not say the word. I ask why the agent thought it needed one.
This is the same posture I landed on when my agent said it was blocked and had the keys the whole time: an agent’s claim about what it may not do is a claim, not a fact. The rule text is the fact. Read it.
If you write rules for an AI agent, check yours for the two parts. Name what is gated: external and irreversible. Name what is not: internal and reversible. A gate with no stated boundary will find its own boundary, and the agent will draw it at the safest possible place. That place is your inbox.