What an AI agent should never be allowed to do

First, what agents are good at

None of this means agents aren't worth it. They're good at the work that's clear, repetitive and easy to check: sorting incoming requests, drafting updates, summarizing long threads, filling in routine details, and flagging what needs a person. In Relay, that's the kind of task they take on, and their output goes back to the team rather than straight out the door.

They're bad at anything where a mistake is expensive and hard to spot. That's the line the rest of these rules protect. The goal isn't to stop agents doing things. It's to make sure that when one gets something wrong, the mistake is small, visible and easy to undo.

Rule 3: the kill switch fails closed

Every agent system needs an off switch, and the off switch needs one property above all: if it can't be read, the answer is off. Relay's kill switch works that way. A missing setting or a failed read stops the work rather than letting it run.

Rule 4: an empty list means no

This is the one we got wrong first. Relay keeps a list of the projects agents are allowed to work on. In an audit, we found that if the list was missing or couldn't be read, the code treated that as permission to work on every project. Agent work was switched off at the time, so nothing came of it, but the default was backwards.

The fix is one rule: when the allowlist can't be read, send nothing. Check any system you run for the same mistake. Code that falls open usually looks perfectly reasonable when you read it.

Rule 5: limits on everything

Agents retry when they fail, which is helpful until they retry forever. Relay stops after three tries and moves the task to a queue for a person to look at. It also caps how many agents run at once, and skips any task marked as needing human review.

Rule 6: a person decides what's on

We considered a daily spending cap and decided against it. A dollar figure isn't connected to whether the work is worth doing. The person who switches the work on is the right judge. So in Relay, a person decides when agents run and which projects they can touch, and each agent's tools are set one by one.

Rules worth stealing

Relay is our own system, but the same limits apply to any business putting agents to work. A few we'd write down on day one:

Drafts, not sends. An agent can draft a customer email, a quote or a social post. A person sends it. The time saved is in the drafting anyway.

No money, ever. No refunds, payments, transfers or price changes without a person approving each one. The cost of a mistake is too high and too hard to undo.

Nothing it can't undo. If an action can't be reversed, like deleting records or emailing a whole list, it doesn't belong on the agent's list of tools.

Every action leaves a trace. You should be able to answer "what did the agent do yesterday, and why?" in a couple of minutes. If you can't, you can't safely give it more to do.

If you're starting with agents

Start smaller than you think. One agent, one kind of task, a short list of tools and a person reading the results every day. Widen it only once the boring version works.

Write the rules down before you need them. The time to decide what an agent should never do is before it does it. Agents are changing how customers find businesses too, which is a different story, covered in why organic rankings still matter with AI agents.