Risky actions should require approval, not review afterward. Lessons from giving agents write access to CRMs, invoices, and calendars

Full disclosure, I am one of the founders of Conecto. Our lessons come from building it. For context, Conecto gives agents access to over 580 tools across 52 business areas. The agent has both read and write access to a company’s data. An agent can update books, create invoices, send booking invitations, among other write capabilities. That ability had to be taken into account when we designed the tools. Lesson 1, put the price in the tool description -> Every description states what a tool costs. Every action returns the cost and the balance after the tool call. An agent can add up a job before it starts. Lesson 2, retries have to be safe -> An agent that times out retries, and no one wants to be billed multiple times for the same job. All calls take an idempotency key, meaning that retries do not result in multiple charges. Lesson 3, approval is superior to review -> Since it is unlikely that a human reads every action of an agent, those that are risky require approval. Some actions default to waiting for explicit owner approval, such as modifying HubSpot/Salesforce records, canceling meetings, or replacing files in Google/Microsoft 365 workspaces. Those actions display the new and old values to the owner. Any tool can require approval, always or only over a set amount. The caller can never be the approver (i.e. the agent can't approve itself). Lesson 4, budgets act as the safety net -> Daily budgets of $20 and monthly ones of $100 by default. The cap prevents rogue loops from hitting the bank account. What we haven’t definitively solved yet -> There are actions that are in a gray zone, neither safe nor risky, for example rescheduling an event. These gray zone actions do not require a human in the loop, unless the owner enables it. Every business is different, so what may be safe for one business may be seen as risky for another. Question -> For your systems, what requires an approval from a human, and which actions are run on autopilot?