Autonomy with boundaries: why approval is a feature
Full autonomy is easy to demo and hard to trust. The useful version lets you decide, action by action, what happens without asking.
The B.R.A.I.N.E.R. team
There is a version of this product that sounds more impressive: describe a company, walk away, come back to revenue. It demos beautifully. It is also the version nobody sensible would connect to their bank account and their customers' inboxes.
Some actions are not reversible
Publishing a page can be undone. Sending three hundred emails to real people cannot. Neither can charging a card, changing a price a customer already saw, or shipping a release that breaks something. The cost of a mistake is not evenly distributed across actions, so the permission to act should not be either.
- Reversible and low-stakes: fine to run on its own.
- Outward-facing and public: usually worth a look first.
- Spending money or changing what customers pay: your call, every time.
The setting is the product
Rather than one autonomy slider, each kind of action carries its own rule. You decide which ones run automatically and which wait for you, and you change your mind as trust builds. Most people start with everything held, then release the boring things first.
Visibility is the other half
A boundary you cannot audit is not a boundary. Every action taken on the company's behalf is visible and recorded, which means the question is never whether something happened — only whether you would make the same call again.
Autonomy you cannot inspect is not autonomy. It is hope with a progress bar.