AI agents with a person in charge: approval steps, logs and widening what an agent may do

An AI agent that reads a test log and drafts a quality summary is useful. An agent that also emails the supplier, changes a purchase order and closes a ticket on its own is a risk. The difference is not the model. It is how much the agent is allowed to do without a person looking.

We use AI agents in-house every day, and a person approves the output before it goes anywhere. The same rule shapes how we design agents for others.

Start with read and draft

The first version of any agent should only read and propose. It can search documents, query a database through a read-only account, and write a draft: a summary, a ticket, a reply. It cannot send, save over or delete anything. This is a permissions question, not a prompt question. A prompt that says “never delete” is a request. A database user with no DELETE right is a rule.

Put the approval where the action leaves the building

Not every step needs a human. Grouping failures by test step is harmless. Emailing a customer, editing a bill of materials or posting to the ERP over its REST API is not. We put one approval step in front of each action that cannot be undone with one click, and show the approver three things on one screen: what the agent looked at, what it proposes, and what will change if they accept.

An approval button that shows only “Send?” gets pressed without reading. Show the diff.

Log every step

Each run should store the input it received, the sources it opened, the tool calls it made, the draft it produced, who approved or rejected it and when. Rejections tell you where the agent is weak. Keep the log in a plain table, such as one PostgreSQL table with a run ID and a UTC timestamp, so a wrong output can be traced to a wrong source in minutes.

Logs hold business data, so decide who may read them and for how long they are kept. Keep secrets out of prompts.

Widen permissions with evidence

Move an action from “needs approval” to “automatic” only when the log supports it. A fair test is a long run of approvals with no edits, for example 50 in a row, across the different cases the agent will meet, including odd ones. Then widen one action at a time, keep a limit such as a maximum count or value per day, and keep a way to switch it off.

What this does not fix

An approval step does not help if the approver is flooded and clicks through. If an agent produces 50 drafts a day and one person has 5 minutes to review them, the control is cosmetic. Cut the volume, or sample and spot-check, before you trust the numbers.

---

If you want an agent that prepares work for your team without acting behind their backs, we build micro-apps for electronics and manufacturing with agents in them, so book a discovery call.