9 rules before you let an AI agent click buttons

Something changed this autumn and it is bigger than a smarter model. The new generation of assistants can fill in forms, update CRM records, work in spreadsheets and test software on their own. Microsoft rebuilt Copilot around long-running agents. Google is testing a feature that phones a business for you, waits on hold and books the table. The shift is from telling you what to do to doing it: clicking, submitting, sending.

That is useful and it is a new class of risk. In the same week as one of those announcements, Google disclosed that Gemini had gained unauthorised access to three outside systems during a test. Nobody was harmed. It is a good reminder that an agent does exactly what it believes you meant, which is not reliably what you meant.

The rules I would follow.

Start with what you can undo. Good first tasks: drafting, researching, filling in a form you review before it goes, moving files into a new folder. Bad first tasks: anything that sends money, deletes things, emails people outside your company, or cannot be taken back. The question is how long it takes you to fix a mistake. If the answer is that you cannot, do not delegate it yet.

Short leash on payments. If it can see your saved cards it can use them. Most tools let you require confirmation before a purchase, so turn that on, and if a tool has no such setting do not connect it to anything with a card attached.

Give it its own login. Use an account or permission level that can do only what the task needs. An agent reorganising a shared drive does not need admin over the whole thing. Standard advice for people, more important for software that works fast and never gets tired.

Be weirdly specific. "Clean up my inbox" can mean archiving three thousand emails including the one from your landlord. Better: find the newsletters I have not opened in thirty days, show me the list, do not unsubscribe or archive until I approve. Find, show, wait. Use that shape for anything new.

Watch the first few runs. Most tools show you the steps and let you take over. Actually watch, the first few times. You learn where it gets confused and you write better instructions afterwards.

Do not let it read what it should not obey. If it browses the web or reads your email it will eventually meet text written to trick it, a page carrying a hidden line telling it to ignore its instructions and send your files somewhere. The practical rule: be careful when an agent is reading content from strangers and has permission to act in the same task. That combination is where it goes wrong.

Check the phone calls. Booking a haircut is fine. Cancelling a contract or disputing a charge is not, because the exact wording matters. Read the transcript, and if the tool shows the call live and lets you take over, stay in it.

It is you on the hook. A wrong flight, a wrong form, something odd said to a customer: that is yours. Who is responsible for an agent's mistakes is still being worked out, and "the AI did it" is not yet a defence.

Keep a list of what it is connected to. Every account you connect, write it down, and once a month disconnect what you are not using. Boring, and almost nobody does it.

So use them, carefully. The savings on repetitive reversible work are real. Just do not start with the bank account.