Giving Your AI Permission to Act Without Permission to Be Reckless

The reason most people don’t let their AI do real work isn’t fear that it’ll be wrong. It’s fear that it’ll be wrong fast. The model is happy to send the email, publish the post, or delete the file the moment it thinks that’s what you wanted. Usually it’s right. Sometimes it isn’t. The cost of the rare bad call is high enough that most people just… don’t hand over the keys.

There’s a pattern that fixes this without slowing the AI down for everything else. It’s called an approval gate, and once you’ve seen it, you’ll wonder why it isn’t the default.

The split: read freely, write carefully

Most of what an AI assistant does in a working session is read-only: searching, looking things up, drafting, suggesting, planning. Reading is fast, low-risk, and easy to verify. Mistakes there cost nothing — you just don’t use the bad output.

A small fraction of work is write-only: sending an email, publishing a draft, deleting a file, charging a card, posting to social. Those actions touch the world. Mistakes there cost something. Sometimes a lot.

The approval-gate pattern says: let read run free; pause every write for a one-tap approval. You get the speed of an autonomous agent on the parts that don’t hurt and the safety of supervision on the parts that do.

What it looks like in practice

You ask your AI to draft a newsletter. It reads your past issues, drafts the new one, checks the links. None of that asks for permission. The draft lands.

You say “publish it.” Now a message lands in front of you with a preview of what’s about to happen and two buttons: Approve, Decline. You scan it. You tap Approve. The post goes live.

Same shape for sending an email, queuing a calendar invite, or modifying a record in your CRM. Read happens silently. Write pauses for one tap.

How it’s built (in plain language)

Modern agentic AI tools support something called hooks. A hook is a small script that runs at a specific moment — before the AI uses a tool, after it finishes, when a session ends. The relevant one for the approval gate is the pre-tool-use hook: it runs before the AI is allowed to do anything destructive, and can either let the action through or pause it.

The implementation is small. The hook checks: is this a destructive write? If yes, surface the action to the human (Slack message, push notification, email, whatever interface you live in) with two buttons. Wait for the answer. Pass the answer back to the AI.

Tools like Claude Code and the Anthropic Agent SDK ship this primitive built in. You don’t need to build the orchestration — you just need to write the “ask the human” part for whatever interface you want.

Why this beats the alternatives

It beats don’t let the AI do anything

That approach trades safety for time. Every action becomes a copy-paste. The AI is reduced to a chatbot. You lose the leverage of automation entirely.

It beats let the AI do anything

That approach trades safety for speed. The AI is fast, sometimes wrong, and the wrongness happens in the world before you see it. One bad publish, one wrong recipient on an outreach email, and you’re cleaning up in public.

It beats case-by-case manual rules

Some people try to enumerate every dangerous action and write a rule for each (“don’t email anyone outside this list,” “don’t publish on Sundays,” etc.). This works until it doesn’t, because there’s always a case you didn’t list. The approval gate flips it: by default, all destructive actions pause, and the few that are safe enough to skip the gate are the explicit exception.

Where it gets even better

Once the gate exists, you can build patterns on top of it that wouldn’t be possible otherwise:

• Quiet hours. Approval prompts queue silently after 8 p.m. and land in a single batch in the morning.
• Auto-allow learning. Actions you’ve approved 50 times in a row get promoted to skip-the-gate. The system gets faster over time without ever lowering the safety floor.
• Audit trail. Every approval is a log entry. You can scroll back and see exactly what the AI did, when, and that you said yes.

Those second-order capabilities are what makes the pattern compound. A taste of how it stacks: What I Built Into Claude Inside My Slack.

The reframe

Permission to act and permission to be reckless are different things. Most people conflate them and end up with an AI that’s too cautious to be useful. The approval gate splits them: act freely on the safe stuff, pause for one tap on the rest. That one split is the difference between an apprentice and a chatbot.

---

Related: The CLAUDE.md Pattern · Turning Slack Into Your AI Command Center · How to Set Up Claude in Slack.