Drafts only by default

More than ten clients have now asked us for the same thing in slightly different words. They want the agent to do the grind on its own. The research, the scoring, the drafting, the scheduling. And they want a person in front of anything that cannot be taken back. An email to a real customer. A post under the company name. A payment. A published page.

So that is the default we build to. Drafts only, until someone approves.

Sort every action first

The first thing we do on a new build is sit with the client and put every action the agent could take into one of two lists. Runs unattended, or needs sign-off. The test is whether it can be undone. Reading a CRM record is unattended. Writing a lead score into a spreadsheet is unattended. Sending an email is not, because you cannot unsend it, and the client's fear was never that the agent would write a bad draft. It is that the agent sends a bad one to a real person.

The sorted list is short and it goes into the agent's knowledge base as a plain rule. The rule is not what enforces it though.

The gate lives in the tools

A line in the prompt that says "do not send without approval" is a request. The agent honours it most of the time, and most of the time is not the standard for a customer-facing email. So the agent gets a tool that writes a draft and no tool that sends. If there is no send capability in its hands, no confusion and no injected instruction can send anything.

On a lead-generation system we built for a travel business, outreach emails land in the client's own Outlook drafts folder. The client opens their mail in the morning, reads each draft, edits what they want and presses send themselves. LinkedIn messages cannot be staged as drafts, so those go into a daily digest instead. The agent writes the message, the digest lists it, the client copies over the ones they like. Nothing goes out without a person touching it. That one choice, made on day one, is what made the whole system feel safe to them.

A campaign agent we run for another client picks the offer, writes the copy, updates the web page and schedules the sends. The whole campaign goes to a Discord channel for the client to review and approve before it runs. If they do not approve it, it does not run. Silence is a no.

Spend is an action too

Money is the other thing you cannot take back, and it is easy to miss because it does not feel like sending. On a contact-building agent for a real-estate operator, the paid step is revealing verified contact details from a data provider. All the free work runs first, matching properties to companies and ranking the likely decision makers, and only then does the agent post a cost estimate. This many reveals, roughly this much. The client approves the estimate and only then does the paid call run, under a monthly ceiling agreed before we wrote any code. Every paid call goes into a ledger so you can check the estimate against what was actually spent.

We learned that one the hard way. An early build had a research step that could spend with no cap on it, we had to go back and rework it. Ceilings go in up front now on anything that touches a paid API.

What the person sees

A gate only works if the person reads it. If the approval message is a wall of text they stop reading and approve everything, and now there is no gate. So the message is the draft itself, or one line per queued item saying what it is and where it came from, or one estimate with one number to say yes to. At My Performance Doctor (myperformancedoctor.com) we put two gates on the decisions that matter and let everything else run. Two, not twelve. That is the whole cost of staying in control.

For anything published on a regulated client's behalf there is a script gate in front of the human one. A script checks every citation in the draft against the live source before a person ever sees it, as a hard pass or fail, with a second adversarial check behind the first. A draft with a made up reference in it never reaches the approval step, so the person approving is reading for judgement and not checking facts.