Prompts / Agents and automation
Write an approval policy for an AI agent
You get a clear three-tier rulebook for what an AI agent may do alone, what needs your approval and what is off limits. It works because it forces you to list every action first, so risky ones can't slip through unnoticed.
Partly workedThe reply has the right structure and covers the stated preferences well. It likely runs to about 450 words, which breaks the 400-word cap. It never lists actions separately by app before sorting them. It also doesn't mark the unclear actions in the tier lists, so they only appear later in the decisions list.
The prompt
Act as a cautious operations consultant who designs safety rules for AI assistants that work on a person's behalf.
Task: Write an approval policy for an AI assistant doing the job in {agent_job}. It can use the apps in {connected_apps}. Respect the owner's wishes in {approval_preferences}.
Steps:
1. List the actions the assistant could realistically take in this job, grouped by app.
2. Sort each action into three tiers: act freely (read-only or easily undone), ask first (anything that sends, posts, spends money, changes or deletes), and never do.
3. For every ask-first action, write a one-line rule beginning "When it wants to...", then say what the approval message should show the owner.
4. Mark any action whose tier is unclear, and give a recommended default with a one-sentence reason.
5. Check every stated preference is covered and point out any conflicts.
Output: Three headed lists (Act freely, Ask first, Never), then a short approval message template, then a "Needs your decision" list. Plain English, under 400 words.
Change the parts in curly braces. Use it before you give any AI agent access to email, payments or other live accounts.
What happened when we ran it
We sent
Act as a cautious operations consultant who designs safety rules for AI assistants that work on a person's behalf. Task: Write an approval policy for an AI assistant doing the job in Run my small bakery's customer inbox each weekday morning: read new enquiries, draft replies, keep the order calendar up to date, and chase unpaid invoices that are more than 14 days overdue.. It can use the apps in Gmail, Google Calendar, Xero (invoicing), Slack channel #bakery-orders. Respect the owner's wishes in I'm happy for it to read anything and to draft replies. It must never send an email or Slack message without my say-so, never issue refunds, and never change prices. Adding a calendar entry for an order under £200 is fine without asking.. Steps: 1. List the actions the assistant could realistically take in this job, grouped by app. 2. Sort each action into three tiers: act freely (read-only or easily undone), ask first (anything that sends, posts, spends money, changes or deletes), and never do. 3. For every ask-first action, write a one-line rule beginning "When it wants to...", then say what the approval message should show the owner. 4. Mark any action whose tier is unclear, and give a recommended default with a one-sentence reason. 5. Check every stated preference is covered and point out any conflicts. Output: Three headed lists (Act freely, Ask first, Never), then a short approval message template, then a "Needs your decision" list. Plain English, under 400 words.
The model replied
# Bakery Inbox Approval Policy
## Act freely
- **Gmail:** read, search, label, and draft replies (drafts are never sent).
- **Calendar:** read the calendar; add an entry for an order under £200.
- **Xero:** read invoices, contacts, and payment status; list invoices over 14 days overdue.
- **Slack:** read #bakery-orders.
## Ask first
- **When it wants to send an email** (enquiry reply or invoice chase), show: recipient, subject, full text, and why it's being sent.
- **When it wants to post in Slack**, show: channel, full message, and the reason.
- **When it wants to add a calendar entry for an order of £200 or more**, show: customer, date/time, order value, and details.
- **When it wants to edit or delete a calendar entry**, show: the current entry, the proposed change, and the reason.
- **When it wants to send or resend a Xero invoice or reminder**, show: invoice number, customer, amount, days overdue, and message text.
- **When it wants to create or edit a Xero invoice or contact**, show: what changes (before and after) and the amount.
## Never
- Send any email or Slack message without your approval.
- Issue refunds or credit notes.
- Change prices (on invoices, quotes, or product lists).
- Delete emails, invoices, or contacts.
- Void or write off invoices.
## Approval message template
> **Approval needed: [action type]**
> **What:** [one-line summary]
> **To/Where:** [recipient or channel]
> **Details:** [full text or before/after change]
> **Why:** [trigger, e.g. "Invoice #123 is 19 days overdue"]
> **Reply:** Approve / Edit / Decline
## Needs your decision
1. **Calendar entries with no stated value** — *Default: ask first*, because the under-£200 rule can't be checked without a value.
2. **Editing a calendar entry the assistant created** — *Default: act freely for small fixes (e.g. typos), ask for date or time changes*, because a wrong time could cause a missed order.
3. **Archiving or labelling emails** — *Default: act freely for labels, ask before archiving*, since labels are easily undone and archiving can bury messages.
4. **Chasing invoices: repeat reminders** — *Default: ask each time*, because tone matters with regular customers.
5. **Invoices disputed by the customer** — *Default: don't chase; flag to you*, since chasing a disputed bill could harm the relationship.
## Preference check
- **Read anything / draft replies:** covered (Act freely).
- **Never send without say-so:** covered for email and Slack, including Xero reminders, which send email.
- **No refunds, no price changes:** covered (Never).
- **Calendar under £200 is fine:** covered.
**Conflicts:** None direct. One tension: the job says to "chase" overdue invoices, but chasing means sending, so every chase needs your approval. Expect a daily approval queue.
Run on Claude Sonnet 5.5, 03 Nov 2026. Automatic check: 3 out of 5.
Mentioned for
ChatGPT, Claude, Gemini
Where it came from
Found on GitHub, shared by composio-community: composio-community/open-dot.
This is our own version of the idea, written and tested by us. The original may differ.