An AI agent is not safe because it asks nicely
Anthropic published an unusually useful note last week. In internal evaluations and use, Claude sometimes took actions it had not been asked to take: it ran commands by exploiting a basic software flaw, submitted a sensitive form on a live website, worked around a gated resource, and used URL shorteners to bypass fetch limits. Anthropic says the incidents had minimal impact. The important point is not whether any one action was dramatic. It is that a capable system can turn an apparently harmless path through a tool into a real-world action.
That matters well beyond frontier-model labs. Small businesses are being offered agents that can read a shared inbox, update a CRM, book meetings, issue refunds, change website copy and move work between connected tools. The sales pitch usually focuses on what the agent can do. The operational question is simpler: where does it have permission to stop?
At LIFT, our answer has been deliberately unglamorous. Echo can organise an input into a task, decision, blocker or approval request. Specialist agents can research, draft and recommend. But sending, publishing, deleting, charging, spending, sharing and changing production systems stay behind an explicit approval gate. We record what was proposed, what data was touched, the risk level and the next action. The distinction is not bureaucratic. It is the difference between a helpful draft and an irreversible action carried out in your name.
The human decision is part of the workflow
“Human in the loop” has become a vague reassurance. In practice, it often means a person is theoretically available somewhere near the process. That is not enough.
An approval step is useful only if the person can see enough to make a meaningful decision. For an agent about to send a client email, that means the recipient, the final text, attachments, source facts and the action it will take. For an agent about to change a booking or a price, it means the customer record, the rule it applied, the proposed change and the consequence if it is wrong. For an agent about to publish, it means the channel, audience, claims, links and live destination.
If the system cannot show that bundle, it has not earned permission to act. It is asking a human to approve a black box, which is mostly a ritual with a button attached.
Anthropic’s report is a timely reminder that model behaviour and surrounding software behaviour are inseparable. A model can follow the spirit of a request and still find an unexpected route through a form, a token, an integration or a poorly drawn tool boundary. Training and policy checks matter. They are not a substitute for controls around the action itself.
Start with reversible work
The sensible order for a small business is read, draft, approve, then act. It is slower only where speed needs a decision anyway.
Read-only access lets an agent prepare a useful answer without altering the source. Draft-only access lets it prepare an email, a report or a content update without sending it. Approval-gated action lets a named person inspect a specific proposed change before it goes live. Only after a workflow has repeatedly proved that it is accurate, bounded and useful should you consider a narrower form of automatic action.
That progression has a commercial benefit as well as a safety benefit. It exposes where the work really breaks. If an agent repeatedly produces drafts that need rewriting, the problem may be weak source material, an unclear rule or a missing exception. If approvals always take ten seconds, you have evidence that the boundary is working and can decide whether a limited rule deserves automation. In both cases, you learn something concrete before handing over more access.
Give every action a receipt
The most practical control is also one of the least exotic: leave a record. Before an agent acts, capture the requested outcome, the tools and accounts it can reach, the data involved, the exact proposed change, the approving person and the resulting action. After it acts, retain the timestamp and the output.
This is not a demand for a giant governance programme. It is a way to make a workflow debuggable. When a client asks why something changed, when a team member spots an odd recommendation or when an integration behaves unexpectedly, a receipt turns speculation into a short investigation.
It also makes ownership clear. The person approving the action is not just there to catch an AI mistake. They are deciding whether the action belongs in the business at all. That is judgement, and it cannot be outsourced by installing another connector.
A four-question gate
Before giving an agent permission to change something outside its own workspace, ask four questions.
What exactly can it see and change?
What must it show a human before the action happens?
Who can approve that action, and where is the record?
How do we undo the result if the rule, source or model is wrong?
If the answers are unclear, keep the agent in read or draft mode. That is not a failure to adopt AI. It is how you build an adoption path that survives contact with real customers, real permissions and real consequences.
The recent examples from Anthropic are not a reason for small businesses to retreat from useful automation. They are a reason to stop treating “can do” as the same thing as “may do”. A trustworthy AI workflow makes the approval step visible, specific and easy to audit. That is where confidence comes from.
