I set up an AI webmaster my non-technical client emails directly. Here's how it's built, and what broke.

I build and maintain a small nonprofit's website. Her requests arrived as texts with screenshots. I'd paste them into my coding agent, check its work, and report back. The agent was doing the work. I was the router. You can't hand a non-technical owner an AI coding tool and point it at her live site. So here's how it's set up instead. 1. The docs are the webmaster. Before touching any AI, I wrote the knowledge down as a folder of plain documents in the site's own repo: Guardrails: a never-do list. Never edit production directly. Never touch payments without me. Plus every site-specific trap I'd hit before. Services: what each service does, and which account owns it. A decision log, so the agent doesn't "fix" something that was deliberate. A persona: plain words, at most three questions before showing her something, and never go quiet. A rebuild guide, so the whole thing can be stood up again from the repo if the bot platform goes away. The bot is replaceable. 2. Where the agent lives. Grok Bot, xAI's agent product. Each bot gets its own persistent computer in the cloud, with a terminal, a browser and files, so it can clone the repo, run the tests and push branches like a developer would. I'll call the webmaster Ivan. 3. The client never touches the agent. Ivan has his own email inbox, and she just emails it. He checks it several times an hour during the day. 4. One pipeline for every site change. Acknowledge with a time estimate. Build on a branch. Deploy to a private preview link. Wait for approval of that specific link, logged with who, which link and when. Then merge and check the live site. 5. Three lanes. Lane A, content (words, images, dates): Ivan does it himself, with preview-and-approve. Lane B, small code changes: a regression test, the repo's own checks, and sign-off from a second bot whose only job is reviewing Ivan's work. It reads the diff cold. Lane C, money or personal data (payments, refunds, the database): Ivan never does these. He files me a ticket. 6. Safety nets. A scheduled health check on the site's key pages, and a rollback script I've dry-run. If Ivan fails to fix something three times, he restores the last working version and tickets me. That one hasn't been tested yet. What happened I ran a fire drill first, breaking a preview branch on purpose. It turned up two real problems, which I fixed before she ever saw it. Day one: she asked for seven changes to a flyer in under four hours, and Ivan delivered each one. She still texted me once to forward a request, because she thought Ivan was waiting for my okay. Ivan mistook a blurry sidewalk photo from my phone for something she'd sent, and politely asked her to resend it. He reported that new text "fit cleanly at matching size." Zoomed in, it was noticeably smaller than the text around it, with a scrap of the old line still showing. It never reached her. Standing rule now: when the agent says it's done, open the file. So far exactly one live site change has gone through the full pipeline, and I approved that one myself. What I learned Write the instructions down, not into the chat. I shaped Ivan's behavior by messaging him corrections, and every one would have been gone on a rebuild. They now live in one versioned prompt file in the repo, and he pulls the latest copy before every task. The first version doesn't have to be the last. Once it worked, I pulled the setup into a reusable template and stood up a second webmaster for a different site. Give every agent on a shared machine its own key. I run a second webmaster for another site on the same computer. When I set it up, its setup overwrote the first one's SSH key, and nothing warned; the first webmaster just lost repo access. Now each agent gets its own key file, and a rule to never overwrite a file it didn't create. The hard part isn't the AI. It's the context, the permissions and the guardrails. The model was the easy piece. What's left for me is the ticket queue and keeping Ivan running. How do you handle the review step: a second agent, tests only, or a human?