Most advice about building agents points the same direction: give them more. More tools, more autonomy, more reach into your systems. The week I finally had my own agent doing real work, I spent most of the time pulling capabilities out of it instead, and that’s the decision that made it worth keeping.
I’ve been running an agentic OS over my own work for about six months — a chief-of-staff agent that reads my inbox overnight, drafts replies, writes the brief I read with coffee, and preps me for meetings before I’ve thought to ask. I wrote up what six months of that changed about how I think. This is the part I left out: the three hard limits the whole thing runs inside, and why each one, which on its face makes the agent weaker, is the reason I trust it enough to get anything out of it.
Rule one: it never sends
The first rule is the firmest. The agent never sends. No outbound email, no calendar invite, no message that reaches another human. It reads everything and drafts anything. The last inch, where bytes leave my account and land in someone else’s, stays mine, every time.
There’s a reason for that beyond avoiding mistakes, and it sits with the person on the receiving end. Sending someone a message I haven’t read myself asks them to spend their time on words I never spent mine on. That’s disrespectful of their time in a way I feel immediately when it’s done to me — the auto-sent note, the reply nobody bothered to reread before it went. I’m not willing to put my name on one of those.
Early on, one of my agents drafted a reply that confidently described a job I’d never held — an old note in its memory had an employer wrong, and it wrote the error straight into a message addressed to a real person. If the agent could send, that goes out under my name while I’m asleep. Because it can’t, the worst version of that mistake is a bad draft I delete before anyone sees it.
That constraint is what lets me point the thing at everything I’ve got: the whole inbox, every thread, the half-finished negotiation. I never have to scope what it’s allowed to touch, because nothing it does reaches another person without passing through me first. Remove the send button and you remove the need to approve each action. What’s left runs fast.
Rule two: it only reads (mostly)
The second rule: read, don’t write. The agent has read access across my Google Workspace and almost no write access. There are two exceptions, both narrow and both chosen on purpose. It can add to one reminders list I own, and it can save email drafts I’ll review. Everything else is off the table: labels, archiving, deleting, moving, calendar edits.
A write-capable agent is one bad inference away from “helpfully” relabeling a thread, archiving something it judged stale, or reshuffling a calendar it misread. Those edits are quiet and expensive to unwind — the system of record drifts and you notice weeks later, after you’ve already made decisions on top of it.
A read-mostly agent can’t corrupt the ground truth it reasons from. I can run it a hundred times over my real data and the worst case is wasted tokens, never a damaged inbox. That reversibility is the only reason I gave it my actual accounts instead of a sandboxed copy, and an agent reasoning over a stale copy of your life isn’t worth the trouble of building. The two write exceptions earn their place by staying reversible and small: a list I can clear in a tap, drafts I read before they’re anything.
Rule three: sound like me, not like slop
The third rule is the one I’m proudest of. Nothing drafted on my behalf reaches me until it clears a voice check. Every external draft gets graded against a rubric built from years of my own sent mail — how I open and close, the rhythm of my sentences, the words I’d never use — and a draft that fails the check regenerates before it ever hits my screen.
This failure is slow and quiet. Instead of breaking, the output goes flat — the drafts drift a little more generic and a little more LinkedIn-shaped over a few weeks, until they read as competent slop, unmistakably not me. Nothing alerts you, because nothing broke. It just slowly stops sounding like you.
The gate is what makes the drafts usable at all. An assistant whose output I’d have to rewrite from a blank page is negative leverage; I’d be faster alone. Because the draft starts at “almost me” rather than “generic AI,” editing it is two minutes instead of a do-over. The limit on what the agent is allowed to put in front of me is the whole reason what it puts in front of me is worth having.
Three limits, one trust contract
Line the three up and they read like a list of things my agent can’t do. They work like a contract for when I get to stop paying attention.
Each rule trades a capability I rarely need for supervision I’d otherwise owe constantly. I almost never need the agent to send on its own, rewrite my calendar, or mail something I haven’t read, so giving those up costs me close to nothing. In return I get to let it run without standing over it. The bottleneck on a useful agent turns out to be how much of its output you have to check by hand, and every one of these limits shrinks that number.
Compressed to something portable, the pattern is three questions to ask of any capability before you hand it to an agent:
- What’s the blast radius if it’s wrong?
- Can I undo it?
- Will I have to check the result by hand anyway?
Why this matters if you build agents
This isn’t only a personal-productivity story. If you build agent products for other people, the same logic decides whether anyone keeps using them. Users rarely walk away from an agent for being underpowered. They walk away the first time it does something irreversible they didn’t sanction — and after that they supervise every action so closely the agent stops saving them anything. The constraints that feel like you’re underselling the product are the ones that earn enough trust for the product to get used at all.
I argued a few weeks back that once both sides of an ad buy go agent-native, the human’s job relocates to the parts the agents can’t own: the spec, the eval, and the guardrails. This post is me living in the guardrails half of that claim. Knowing which capability to take away, so the person on the other side can finally stop watching, is a product decision, and one you only learn by running an agent long enough to feel the cost of getting it wrong.
Which leaves the question I’d put to anyone building or living with one of these. Write access for your agent: earn it gradually, or never grant it at all? I’ve come down hard on “never” for anything that reaches another person or writes to my system of record, and the agent got more useful the day I drew that line. Tell me where you land — and where I’ve drawn it wrong.