The five-line stop list that makes agent autonomy survivable

An operator who runs a handful of small apps by himself, alongside what he calls a flock of AI agents, has published the short list of actions those agents may never take without him clearing each one: sending anything that reaches another human, touching credentials, doing anything irreversible, standing up new recurring automation, and declaring a task done ^{[1][3][5][7][10][12]}. It matters because that list is the precondition for the autonomy around it: the agents open a browser, edit files, run shell commands, stage deployments and format posts for publishing, and none of it happens in a sandbox ^[2].

The argument is narrow and worth restating without decoration. According to the author, an agent that can only suggest is a slower, more expensive version of himself, so the value comes from letting it act ^[15]; the harness automates the work and refuses to automate the judgment ^[16], and the gates sit exactly where reviewing the result after the fact arrives too late ^[17].

Three of the five lines are about the same property, which is that the action cannot be walked back ^[19]. Anything leaving the machine for another person stops one step short of the send: the agent writes, formats and stages, and the send itself stays with the human, because the draft is cheap and reversible and the send is neither ^[3][20]. He says every article in the series, including that one, was drafted and checked by agents and went out only when he gave the word on that specific piece ^[4]. Credentials are a hard wall: no passwords, no two-factor codes, no account creation, no payment details, and if a task genuinely needs a login the agent hands the keyboard back ^[5]. His reasoning is that the moment an automated system can authenticate as him, one bad instruction can do unbounded damage, so the capability is simply absent from the setup ^[6]. The undo-less category, deleting data, overwriting something he did not create, moving money, changing who has access to what, is gated by a blunt test: if getting it wrong means he cannot get back to where he was, an agent does not do it alone ^[7][8]. A useful sub-rule rides along with it. Before overwriting or removing anything, the agent has to look at the actual object, and a mismatch between what it finds and how the task described it is a reason to stop and ask rather than a detail to push past ^[9].

The other two lines are about evidence rather than blast radius ^[19]. A new recurring job, a scheduled task, a watcher, a polling bot, requires three answers in writing first: what metric it will move, how that will be measured, and the date on which it turns itself off if the metric has not moved ^[10]. That rule was bought at retail. He describes running a fifteen-persona automation for eighteen days with no success metric, thousands of model calls, and no way to prove a single one changed an outcome ^[11]. The last line is that an agent does not get to say a task is done; it has to show the test output, the diff or the rendered screen, and one agent's claim of done is another agent's job to try to refute ^[12]. He attributes that gate to a repeating pattern of tasks reported as finished against a diff that said otherwise, though the published account is cut off mid-sentence at that point ^[13].

None of this is externally audited; it is one operator's self-report, and he is explicit that the list was earned one near-miss at a time rather than designed up front ^[14]. The transferable parts cost nothing to copy: key the gates on reversibility rather than on how risky a task feels ^[8], keep the list short enough to actually remember ^[18], and require an artifact before belief ^[12].