What an agent should not be allowed to do yet
The useful part of an AI project is the list of things the system may not do on its own. Why supervised is a normal operating mode rather than a trial, and why going automatic should be a named decision per automation rather than a date in the plan.
The interesting part of an AI project is not the list of things the system can do. It is the list of things it is not allowed to do yet.
That word is carrying weight. Not allowed, full stop, is a boundary. Not allowed yet is a decision somebody has to make later, on purpose, and the projects that go badly are usually the ones where nobody worked out who makes it or on what basis.
Supervised is not a trial period
Most of what we build starts supervised: the agent does the real work on the real data and prepares the real output, and a person releases it. The draft is genuine. The reminder is written and ready. The purchase order is filled in correctly. Somebody clicks.
People hear that and assume it is a pilot, something you endure for a month before the real version switches on. It is not. It is the normal operating mode for anything with consequences, and plenty of automations should stay there permanently.
Going automatic is a decision, not a milestone
Here is the rule worth adopting, whoever builds your systems: moving one automation from supervised to automatic is a separate decision, made for that automation alone, confirmed in writing, by a named person.
Not a date in the plan. Not "once we are confident". Not a blanket switch at the end of the project that quietly covers nine things nobody reviewed individually.
If nobody can name who decided an automation could run unattended, nobody decided it.
The basis should be evidence you already have, because the supervised period generates it. How many drafts went out unchanged? What did people correct, and was it the same thing each time? Which cases did it escalate, and was it right to? If the answer to any of those is a shrug, it is not ready, and the supervised period has not cost you anything because the work was getting done the whole time.
The three that stay supervised longest
Money going out. A purchase order, a payment, a credit. The failure mode is not embarrassment, it is cash leaving the business for something you did not want, and it is slow and awkward to reverse.
Prices changing. An agent can check prices against the market, apply your markup rules to a supplier file and tell you what it thinks. Letting it set the number is different, because a pricing error does not announce itself. It just sells things for the wrong amount until somebody notices.
Anything that goes out in your name. A customer reading an email does not know or care that an agent wrote it. They know your business sent it. Tone, timing and who is excluded from a reminder run are judgement calls about relationships, and they belong to a person for a long time.
What the exclusions list is actually protecting
Every scope we write has a section listing what is not included, and it is usually the section clients skim. It is worth reading, because most of it is not us limiting the work. It is us refusing to pretend.
The most common example is data. An agent reads what is in your systems. If your minimum stock levels were set years ago and never revisited, the reorder suggestions will be confidently wrong in exactly the way the data is wrong. We will tell you what we found, and fixing it is real work that somebody has to do. What we will not do is quietly imply that the automation will paper over it.
An automation can only be as accurate as the data it reads. That is not a disclaimer, it is a specification.
Write the limits down before you need them
Value caps. Which suppliers are approved. Which customers are excluded from reminders. How often anybody can be contacted. Who signs off what.
None of these are hard questions. They are just questions nobody asks until something has already gone out, and at that point you are not setting a limit, you are explaining an incident. An afternoon spent writing them down before the build is the cheapest part of the whole project.
The short version
Assume supervised by default. Treat every move to automatic as its own decision with a name attached and evidence behind it. Keep money, prices and anything in your name on a person longest. And read the exclusions, because the honest ones are telling you where the real work is.
Want the limits written down before anything is built?
That is how we scope agent work: what it may do alone, what waits for approval, and what it must never touch, agreed before a line is written.
How small business websites actually get hacked
Not by somebody choosing you. By automated scanning that tries a list of published weaknesses and moves on. The four ways in, what AI actually changes, and the question of who is responsible for any of it.
The AI your team is already using
Shadow AI is not a discipline problem, it is people finding tools that help. The risk is that nobody knows what has been sent where. How to find out, and what to do about it without banning anything.