Can AI agents take actions without your approval?

The seven checks

Before an ESR agent takes any step on its own, the request is measured against a permission grant you created. Every check runs independently. Any single one that blocks is enough to stop the action, whatever the others say.

Four of them are limits you set:

• Category. The action has to match the category the grant was issued for. A grant for marketing work does not authorise a billing change.
• Scope. The action’s scope has to be a subset of the grant’s scope. It can narrow what was granted, never widen it.
• Budget. Money already spent plus the estimated cost of this step has to stay inside the grant’s dollar budget.
• Expiry. The grant has to be unexpired and not revoked. Permission you gave last month does not quietly persist.

Three of them cannot be granted away, no matter how the permission is written:

• Irreversible. If the step cannot be undone, an agent never self-approves it.
• Removes a security control. An agent never self-approves weakening its own guardrails.
• External side effect. If the step reaches outside the product, an agent never self-approves it. This is the one that covers sending, posting, publishing and paying.

Why the cost and risk are calculated on the server

A permission check is only as good as the numbers it checks against. If the browser told the server “this action costs zero dollars and is not irreversible”, the budget limit and the irreversibility refusal would both be advisory. So ESR ignores what the client says about cost and risk. Both are derived on the server from the customer’s own request text, using one shared derivation that every entry point goes through.

Category and scope are the exception, and for a specific reason: those two can only ever restrict what an agent may do, because they are checked against the grant the server loaded. A client asking for the wrong category or an out-of-scope action gets denied. Cost and risk are the opposite. A client value there could only loosen a limit, which is exactly why it is never trusted.

What this means in practice

ESR agents draft. They research an industry, write strategy, write content, break a goal into tasks and work through them. They do not send the email, publish the post, or book the meeting. A person clicks. The design decision behind that is not caution about model quality. It is that every one of those actions has an effect outside the product, and external side effects sit behind a refusal that no permission grant can open.

On the Growth and Empire plans the team keeps working overnight, and the same boundary holds. Work accumulates, decisions queue up, and you approve them in the morning.

The question to ask any AI agent vendor

Ask which specific actions the system can take without a human click, and ask where the cost estimate that enforces the spend limit is calculated. If the answer to the second question is “the client sends it”, the spend limit is decoration.