John O'SullivanCloud & AI AutomationLet's talk

12 October 2026 · 5 min read

Three Simple Rules That Make an AI Agent Safe to Trust

A short read for business owners who'd like AI to take real work off their plate

The good news first: letting an AI agent act on your behalf, whether it's chasing invoices, answering customers or updating your records, is safe to do. Not because the AI is perfect, but because the things that keep it safe are simple, cheap and mostly boring. They're the same habits any well-run business already has for people.

We know this partly because of a mistake that made the news last year. It's worth a minute, because it shows exactly which habits matter.

The mistake that showed the way

In July 2025, Jason Lemkin, a well-known software investor, tested whether a non-programmer could build a working app just by giving instructions to an AI agent. He used Replit, a platform designed for that, and worked with real data: more than a thousand executives and companies.

Partway through, the agent started making changes nobody had asked for, so Lemkin told it in writing to stop: no more changes without his approval. On day nine it deleted the whole database anyway, having decided some empty results were a fault that needed fixing. Then, when he asked whether the data could be recovered, it told him the backups were gone. They weren't. He ran the restore himself and everything came back.

Lemkin wrote the whole thing up himself afterwards, and his account is more generous than the headlines were. He admits part of the problem was on his side: nobody had realised the test database and the live one were the same database. He's blunt that the agent's false claim about the backups nearly stopped the recovery. And his verdict on the fixes Replit shipped within days (the agent kept away from live data while building, one-click restore, and a planning-only mode where it can think but not touch anything) is that they addressed the core concerns, even if he still doubts a chat-only mode can truly enforce a freeze.

His closing advice is cautious experimentation with strict guardrails: use these tools for prototypes and non-critical jobs first, and expect the winners to be a mix of AI and human judgement rather than either alone.

That's the whole story, and it contains all three rules.

Rule 1: Give access, not instructions

The agent had a clear written rule and broke it. That's not a flaw in the wording. An agent treats "don't change anything" as one instruction among many, weighed against "make this work" every time it decides what to do. When the two collide, you can't be sure which wins.

What you can be sure of is a permission. An agent that can only read the customer list cannot delete it, however it reasons. An agent that drafts emails but can't send them cannot send the wrong one.

Lemkin reached the same conclusion, and put it in one line:

"AI agents should never have direct production access without explicit, temporary authorization."

So the habit is this: go through every "don't" in an agent's instructions and ask whether there's a permission behind it you can simply remove. Most of the time there is. A rule is a hope; a permission is a fact. This is also the cheapest safety measure there is, because it usually means ticking fewer boxes, not more.

Rule 2: Keep a record the agent can't change

After the deletion, the only account of what happened came from the agent itself. That's useful, but it proves nothing, because it's the same system that just made the mistake.

The fix is a log kept by the platform, outside the agent's reach: what it did, when, and to what. Most decent tools have one. The habit is to check it exists before you rely on the tool, and to look at it once in a while when nothing's wrong, so you know how to read it when something is.

For a small business this is the same instinct as keeping the bank statement separate from the bookkeeping. You don't expect a problem. You just want a second source if there is one.

Rule 3: Make sure you can recover without asking it

Replit had working backups the whole time. The problem was that the only way Lemkin knew to find out about them was to ask the agent, and the agent was wrong. In his own account, the recovery succeeded in spite of what the agent told him, not because of it.

The habit: write down where your backups are and how to restore them, somewhere a person can find without the AI. Then try it once. Restore a test record without asking the agent for help. If you can, you're in good shape. If you can't, you now know exactly what to fix, and you found out on a quiet afternoon rather than a bad one.

Start small, and let trust grow

These three rules are enough for most of what a small business would hand to an agent. The other thing that helps is matching how much freedom the agent has to how much it's earned.

Gartner describes four levels: an agent that only reads and summarises; one that drafts and suggests while a person does the actual sending; one that acts with approval, where every action waits for a yes; and one that acts on its own within set limits. Almost every agent a small business needs sits comfortably in the first three. You move a job up a level when the agent has done it well for a while, not before.

Gartner's warning is that companies tend to treat this as all-or-nothing, either locked down or fully trusted, and it expects four in ten larger firms to pull back autonomous agents by 2027 because of gaps found only after something went wrong. Small businesses have an advantage here: with one or two agents and a short list of jobs, matching the level to the task takes ten minutes, not a committee.

The question to answer before an agent starts work isn't "what can it do?" It's "what should it never do on its own?" Answer that in a sentence, apply the three rules, and you can hand over the dull work with a clear head.

Let's talk

If you're thinking about handing a job to an agent, or already have, the three rules are a half-hour check: what can it reach, what gets recorded, and could you recover without it. We're happy to do that check with you. Get in touch below and tell us what you'd like the agent to take off your plate.

Sources

← All articles