The real problem with AI agents is the last click

I keep seeing people talk about making agents more autonomous, and I get the appeal. But the more I test these workflows, the more I think the scary part is not the agent being wrong. It’s the agent being wrong and still having permission to do the final action. Send the email. Update the CRM. Reply to the customer. Change the database. Publish the post. Cancel something. That last step is where a task turns into a consequence. I’m starting to trust agents more when they stop one step earlier. Let them read the messy input. Let them summarize. Let them draft. Let them classify. Let them flag what looks weird. But the final click should usually be a person, a rule, or a very narrow workflow with logs. Maybe autonomy is the wrong thing to brag about. The better question might be: what button should this agent never be allowed to press? For people actually building agent workflows, where do you draw that line?