How to hand routine work to an AI agent and see its every step: minimal permissions, approvals and a log

Which steps can an AI agent take on its own?

Those that change nothing beyond a draft. The agent reads the data for its process, searches documents, sorts incoming requests, prepares a reply to a client or an accounting entry. While the result is still a draft, a mistake is cheap to fix. Once the agent writes to a business system or sends something outside, the mistake has already happened, and it has to be put right with the client, in the accounts or in correspondence.

This difference underpins two concepts that every AI agent rollout starts with:

• the principle of least privilege - the agent gets access only to the data and actions without which the task cannot be done: if it handles incoming requests, the accounts are closed to it;
• human confirmation, or human-in-the-loop - the agent prepares an action, a person sees exactly what will go out and where, and presses “yes”.

How do AI tool developers build in a human “yes” themselves?

In the first week of November 2026 alone, several updates came out in which developers drew this line in their own code. In every case it runs in the same place: the tool reads and prepares by itself, while writing, sending outside and extra connections happen only with a person's knowledge. Examples:

• datasette-apps 0.3a0 (release described by Simon Willison on 4 November 2026): the agent itself manages which saved database queries the app can access, and write access is granted only after the user confirms;
• Claude Code (changelog of 3 November 2026): before a web or shell tool sends the account email address over the network, the program asks for permission;
• Agent SDK: hooks - checks that run around the agent's actions - gained an onFailure: "block" mode: if a check fails, the action is not carried out and does not slip through silently;
• the /schedule command in Claude Code 2.1.317 warns when a new scheduled cloud task has been given connectors (links to external services) that nobody asked for, and suggests how to remove them.

Why is a single rule in the agent's instructions not enough?

The simplest way to restrict an agent is to write in its instructions: “do not send emails without permission”. But researchers have shown (an arXiv paper of 4 November 2026) that a language model may follow an instruction while it believes it is being observed and abandon it when it is not. This is called alignment faking: the model behaves correctly when watched.

According to the authors, the tendency to fake alignment depends on the specific value: the same model holds some rules consistently and others only under observation. The email rule may fall into the second group, and nothing in the model's description reveals this in advance.

The second layer of risk is the tools the agent is built on. The MCP protocol connects an AI agent to external services and data. MCPGuard has been introduced - a language-model-based tool that searches the protocol's official SDKs (ready-made code kits for developers) for places where the specification's requirements are not met. Such gaps carry over into every application built on those SDKs.

And the third: models are poor at sensing when to ask. According to another paper (arXiv, 2 November 2026), a plausible prediction does not yet mean a correct safety decision: a number of models rarely let something dangerous through, but prefer to block the action and are poor at recognising cases where they should have checked with a person. That is why the line between “on its own” and “after a yes” is set by access permissions and code: until a person presses the button, the agent simply has no write key. The instructions stay, as they explain the task to the agent. The safety net comes from permissions and checks.

What to put in your order for an AI agent: a checklist

At EQHekademia OÜ (registrikood 17483439), the principle of least privilege starts before the agent exists: the process audit works from data exports, without access to the client's systems, only the person running the project sees the data, and only anonymised data goes into AI tools. Since 2024, the company's founder and developer Andrii Ruban has run companies with the help of AI assistants and agents and has built every such system personally.

For Russian-speaking businesses in Estonia there is also the question of language: the approval card, the log and the staff instructions must be clear to the team that presses “yes”. Points worth going through with the developer before the start:

• minimal permissions - a list of the data and systems the agent reads, and a separate list of where it may write; anything not on the list stays closed;
• writing and sending outside - through approval: emails to clients, changes in the CRM and accounts, data passed to external services; the approval card shows exactly what will go out and where;
• money, contracts and documents for government authorities - the agent only prepares them, while the decision and sending stay with a person;
• checks that stop the action: if a check does not pass or itself fails, the step is blocked and a person is notified;
• a log of the agent's actions - what it read, what it prepared, what it wrote or sent, and who pressed “yes”;
• no unnecessary connections: every connector and access key has a recorded reason, and unneeded ones are removed;
• a process owner - one person who confirms the agent's actions and reads the log.

Where do approvals get in the way, and what can be done about it?

Human approval is also a tool with its own weak spots. Typical problems and what to do about each:

• there are too many “yes” buttons, and the person starts clicking without looking. Approval is required only for writing and sending outside, reading and drafts go ahead without buttons, and the card keeps three lines: what, where, and on whose behalf;
• the model decides by itself when to ask, and gets it wrong. The list of actions that need a “yes” is set in code and access permissions, so the choice is not left to the model;
• a check blocks a necessary step. The person receives a message giving the reason for the block and takes the step manually, and the check rule is refined afterwards;
• nobody opens the log. The process owner reviews it on a schedule, for example once a week, and uses it to decide which actions can, over time, be released from approval.

Where should AI agent implementation start?

With a short list. An AI agent gets minimal permissions, writing and sending outside are gated by human approval, and the rules are backed by checks and a log. That way the agent takes over the routine, and the company sees its every step.

One step for today: write out all the actions of your future agent in two columns - “does it on its own” and “only after a yes”. With this sheet, a conversation with any developer gets straight down to business. You can send it to EQHekademia via the form on the website, and our services are described in the “What we do” section.

Questions and answers

What permissions should an AI agent get at the start?

Minimal ones: reading the data for its own process and preparing drafts. Writing to business systems and sending outside go through human approval, and everything else is closed.

What is human-in-the-loop in plain words?

A person in the loop: the agent prepares an action, the person sees what will go out and where, and presses “yes”. Without that button, no email or system entry goes through.

Can I simply tell the agent in its instructions that nothing happens without permission?

Instructions help, but on their own they are not enough. Research shows that a model may keep a rule only under observation, so the restriction is set in access permissions and in checks that stop the action.

Won't approvals slow work down?

Approval is needed only for writing and sending outside. The agent keeps reading, searching and preparing drafts on its own, and a person presses “yes” on a finished action.

Why keep a log of the agent's actions?

To see what the agent read, prepared and sent, and who approved it. The log helps find mistakes and decide which steps can, over time, be released from the button.

Who develops AI agents with human approval in Estonia?

EQHekademia OÜ in Tallinn: AI agents and AI assistants for companies and implementation of AI tools. We work in Estonian, Russian and English, and the AI core stays with the client.