Give the AI assistant a stop rule before you give it access

A chatbot that gives a bad answer wastes time. An AI assistant connected to your files, calendar, Slack, CRM, codebase, or deployment platform can waste time and touch the thing you now have to clean up.

OpenAI says ChatGPT Work can use connected plugins for Slack, Teams, Google Drive, SharePoint, email, calendars, CRMs, project trackers, and more. It can also use a desktop browser and local apps in the ChatGPT desktop app. Vercel says its agent is read-only by default, runs under its own identity, investigates logs and deployments, and asks for scoped permission before rolling back, changing config, clearing cache, or opening a fix PR.

Those details matter more than the demo. Once an AI assistant can reach the work surface, the normal-person question becomes very plain: what can it see, what can it change, and what happens if it is confidently wrong?

Before a team connects an assistant to everything, it should write the stop rule in boring language.

For a sales assistant: draft the follow-up, fill the notes, flag the missing field, but do not send pricing or change the forecast without a person. For a finance assistant: build the variance deck, cite the source sheets, mark uncertain rows, but do not overwrite the shared model. For a production assistant: investigate, name the likely bad deploy, propose the rollback, but do not change live systems until the plan is approved.

This sounds slower than “let the AI handle it.” It is not. The slow version is letting the assistant act broadly, then making a human replay every step because nobody trusts what happened. Good boundaries are how the time savings survive contact with Tuesday afternoon.

Vercel’s post is useful because it treats permission as a product surface, not legal decoration. The agent proposes a plan. Approval grants a short-lived capability for that plan. Generated code runs in an isolated sandbox before it surfaces a PR or change. The human is not expected to trust a model’s vibes; the system narrows the blast radius.

OpenAI’s ChatGPT Work announcement uses a broader office frame: month-end budget variance, marketing briefs, sales prep, recurring reports, source files, templates, and scheduled updates. That is exactly where many people lose time. It is also where stale context, wrong recipients, and half-finished drafts can quietly spread if the assistant does not show what it touched.

For everyday AI work automation, the approval screen should answer five things before the click: what changed, where the information came from, who will see it, what is still uncertain, and how to undo or park it. If the user still has to open five apps to check those answers, the assistant did not give time back. It moved the checking around.

Do not start with the biggest dream flow. Start with one annoying repeated job and split it into three buckets: safe to do automatically, safe to draft, and must ask first.

A weekly customer-feedback summary might be safe to draft automatically. Sending the summary to the company might need review. Creating Jira tickets, emailing customers, changing renewal status, or updating a live dashboard should probably ask first until the team has proof the assistant is boringly reliable.

Then measure the after-state. Did people paste less repeated context? Did fewer follow-up pings happen? Did the review take less time than doing the task by hand? Did the assistant stop cleanly when the data was missing? If not, more access will not fix it.

Priya Rao would make the rollout earn trust with numbers. Count wrong touches, blocked actions, approval minutes, rework, undo use, and the number of times a person reopened the old app because they did not trust the assistant’s card. The win is not “the AI completed 200 tasks.” The win is fewer repairs after the task is supposedly complete.

Ren Ortiz would drag the same rule into the physical world. If a software assistant needs a stop rule before it edits a forecast, a robot needs one before it moves a cart, opens a door, or changes speed near a person. The closer AI gets to the world, the more visible the pause has to be.

Both views land in the same place: capability is cheap to announce and expensive to trust. The work now is not convincing people that AI assistants can do more. It is making the next action legible enough that people do not have to babysit every inch of it.