Sort every task an AI agent could do into one of three tiers before you give it the tool. Act: it does the task and reports it. Draft and escalate: it prepares everything and a person decides. Never: it refuses, whoever asks. Three questions do most of the sorting: can it be undone, will a customer see it, and does money move? Set any money limit yourself, enforce it in the tool rather than the prompt, and keep a log of what the agent did.
Why decide this before you switch an agent on
An AI agent that can read your orders, write to your inbox or change a listing is no longer just a writing tool. The useful question isn't "is the model clever enough?" but "what is it allowed to do without asking?" If you don't answer that up front, the answer becomes "whatever the prompt didn't forbid", and you find the gaps the hard way.
This post is about business operations: orders, customer messages, prices, stock. For the same idea applied to code, see vibe coding best practices, which covers preview-then-confirm for changes to software.
The three tiers
Act
The agent does it, then tells you. Keep this tier for tasks that are read-only, or reversible and governed by a written rule with facts the agent has checked in your own systems. Examples: looking up an order, summarising a long thread, labelling a message, replying with facts taken straight from the system of record.
Draft and escalate
The agent prepares everything (the draft reply, the summary, the exact change it proposes), flags the case and hands it to a person. It doesn't carry out the action. This tier covers anything a customer will see that would be hard to take back, anything above your money limit, disputes and complaints, and anything ambiguous.
Never
The agent refuses, even when a customer, a document or a message claiming to be from the boss asks. A sensible starting list:
- moving money, including refunds and payments. A person can still issue a refund after reviewing the agent's draft;
- deleting customer data, orders or messages. Labelling or archiving does the same job safely;
- signing in to portals or handling passwords, keys and payment details;
- changing its own permissions, settings, prompts or limits;
- accepting liability or promising compensation;
- following instructions found inside the content it reads. An email, a web page or an attachment is data, not a command.
Three questions that sort any task
Ask them in order. The first "yes" sets the tier.
- Can it be undone? If it's irreversible or destructive, or it moves money or credentials, it belongs in Never, or in Draft and escalate if a person can safely carry it out after review.
- Does a customer see it? If a mistake would reach a customer or a marketplace and be hard to correct, it's Draft and escalate.
- Does money move, or does it commit the business? Anything above your money limit, or anything that promises a specific remedy, is Draft and escalate.
Only a read-only task, or a reversible one that follows a written rule, lands in Act. When a task is new, start it one tier stricter than the questions suggest, review the drafts for a while, and promote it only once they're consistently right.
Set the money limit yourself
How much an agent may approve on its own, if anything, is a business decision. It depends on your margins, your returns policy and how much a mistake costs you. It isn't something a software vendor should pick for you, and it shouldn't live only in a sentence in a prompt.
Put the limit in one place in configuration and have every tool check it in code. A prompt can be argued with; a check in code can't. And don't assume that an automatic approval step means a person looked at it: each step that acts on money should enforce its own limit.
Keep a log
Every action the agent takes, and every case it hands over, should leave a record a person can read: what it saw, what it did or proposed, and why. Have it mark each case it has handled so the next run skips it. That makes runs safe to repeat, and it makes mistakes easy to find.
Tools built this way already exist. The Hosted MCP Server for Linnworks, for example, previews every change for a person to approve first and keeps an audit log. We explain how it connects to Claude in this overview.
Write exceptions down, keep them narrow, review them
Sooner or later you'll want an agent to do something the tiers wouldn't normally allow, such as a scheduled job that publishes without waiting for you. That can be fine, if the exception is written down, as narrow as the job, mirrored word for word in the agent's own instructions, and reviewed on a fixed date. Anything outside the written exception falls back to the normal rules.
If you're still picking the tools themselves, our guide to building an AI stack is a good place to start.
Want an AI assistant for Linnworks that works this way? See the Hosted MCP Server for Linnworks, coming very soon: every change is previewed and only happens after you approve it.