The dangerous personal agent is not the one that refuses to act. It is the one that stays busy. A system rewarded for proactivity can manufacture an impressive queue while imposing review costs and distracting staff with weak assumptions. The commercial test is how cheaply a person can inspect its work and stop it.
An episode of The AI Daily Brief offers a useful early field report. It says Claude Duet immediately requested connections to Slack, Gmail and Drive before proposing several proactive projects. One project repeatedly raised a false alarm about podcast advertising slots until the user terminated that workstream. The report also says the agent proved more useful when it proposed responses to emails of the kind the user would normally star, including a substantive proposal that the user judged largely complete. This attributed account is useful as a design prompt, but insufficient as proof of general product performance.
The contrast matters because initiative and authority are separate design choices. Initiative lets an agent notice neglected work and prepare a response from available context. Authority lets it send the message or commit the company. Combining them may remove an approval click, but it also turns a mistaken interpretation into an external event.
A draft is commercially different from a dispatch. Google’s Gmail documentation describes drafts as unsent messages carrying the system’s draft label. It also explains that sending a draft deletes it and creates a new message carrying the sent label. That boundary is mundane and valuable because work can accumulate without acquiring external consequences.
Personal agents should exploit that boundary rather than racing across it. Their first job should be to reduce the cost of deciding. A prepared email can show the proposed response alongside its supporting material, while separately flagging uncertainty. The reviewer should be able to correct it or kill the workstream without conducting a long conversation with the agent.
Consider an explicit hypothetical. An agent monitoring a sales inbox notices that a prospective customer has waited four days, finds the relevant product material and drafts a reply with suggested meeting times. No promise has left the company, so the initiative remains reversible. If the agent instead sends a discount or accepts a contractual condition, its mistake becomes harder to unwind. The approval boundary should follow the consequence of the action rather than the apparent simplicity of the interface.
Permissions alone will not solve this. Google describes an authorisation scope as defining the data an application accesses and the level of access it receives. Its Gmail documentation classifies the compose scope as permission to manage drafts and send emails. That pairing shows why a company may need operating controls narrower than the technical credential held by the agent.
There is a real counterargument: approval also consumes labour. Requiring a person to inspect every harmless, reversible action can destroy the economic value of automation. Suppose an agent has repeatedly classified low-risk internal notes correctly, with every change recorded and easy to undo. Keeping per-item approval in that explicit hypothetical would protect little while preserving the handling cost. The answer is graduated authority rather than permanent supervision. Authority should expand only where errors are cheap to reverse and the review record supports confidence in the defined task. It should expire or return to approval when the task changes materially.
This changes how a buyer should assess a personal agent. Ask the vendor to demonstrate the interruption path rather than only the successful run. Can a manager see why a task was created and what approval will trigger? Can one noisy task be stopped without disconnecting the whole agent? A vendor should also explain how authority expires and how exceptions return to human review.
The same discipline should shape a pilot. Give the agent one neglected queue where prepared work has value and mistakes remain containable. Measure the time spent reviewing proposals against the time saved by accepted work. In another explicit hypothetical, an agent generating twenty drafts and earning approval for two may be creating theatre rather than capacity. Count an action as completed only after a responsible person accepts the result.
Leaders should assign the agent a clear delegation envelope. It might search approved repositories and prepare customer correspondence while remaining barred from changing prices or accepting terms. Broader authority can follow if the review record justifies it. If authority expands merely because the product can technically support it, convenience will have replaced governance.
The episode’s provisional verdict was that personal agents had become a small proxy for the user rather than his main way of interacting with artificial intelligence. That modest role is commercially promising. A junior proxy does not need control of the company calendar and inbox to earn its keep. It needs to find work worth finishing and place an inspectable proposal before the person entitled to decide.
Maximum autonomy makes an attractive demonstration because nothing interrupts the performance. In a functioning company, interruption is part of the product. The valuable personal agent will prepare useful work, recognise the limit of its authority and surrender control at the right boundary.
sources
Prepared with assistance from a Useful Engine agent workflow. Factual and editorial checks are part of the publishing process.