Why a person approves before the AI acts

There is a quiet assumption in most AI products: that the goal is an agent that acts on its own. The more it does without you, the better it supposedly is. We do not build towards that. The goal was never an AI that acts alone — it is an AI you can trust to act. Those are not the same thing, and the difference is the whole point.

An agent that acts alone asks you to trust it in advance, before you have seen what it will do. An agent you can trust to act earns that standing one decision at a time, where you can watch. We chose the second. It is slower to look impressive and far harder to regret.

The agent proposes; a person approves

Everything our agents do begins as a proposal, not an action. When an agent decides a record should change, a message should go out, or a relationship should be updated, it does not reach into the system and do it. It drafts the change and sets it down for a person to review. Nothing touches the live system until someone approves it.

This is what we mean by suggest-mode. The agent does the work of thinking — reading the situation, drafting the response, proposing the update — and a person does the work of deciding. The human stays the author of record. When the change finally lands, it lands under a person’s approval, with the agent’s draft and the reason both attached to it. You are never in the position of discovering, after the fact, that something acted in your name while you were not looking.

The cost is obvious: a person is in the loop, so the loop is not instant. We think that cost is the feature. The moment of approval is the moment trust is actually exercised, rather than assumed.

Sending it back is a teaching signal

Approval is not the only move. The more interesting one is sending the work back.

When a draft is not right, you do not just reject it — you return it with a revision note: this is close, but the tone is wrong; you missed that this customer is mid-dispute; check the figure before sending. That note is not only a veto. It is a correction the agent can learn from, an instruction in the specific language of your business that no generic model could have known on its own.

A plain yes/no would throw that signal away. By treating the revision note as a first-class part of the flow, every rejected draft makes the next one better. The human is not just a gate the work has to pass through; they are the source of the judgement the agent is being shaped by.

Authority is earned, not granted

Not every action deserves the same scrutiny forever. An agent that has proposed the same kind of change a hundred times, and been approved a hundred times, has earned something a brand-new agent has not.

Latitude grows with track record. A new agent’s every move is reviewed closely, the way you would check an intern’s work before it goes out. As its proposals prove reliable in a given area, the review on that area can loosen — the same way a junior colleague becomes a senior one and stops needing a second pair of eyes on routine work. Authority is earned through a history of good decisions, not granted on day one because the software shipped.

Crucially, this is a setting you control, not a threshold the system crosses on its own. The trajectory from closely watched to trusted is one you author, deliberately, as the evidence accrues.

The autonomy ladder — and where ours costs you

Our position is one point on a ladder, and it is worth being honest about the rest of it. At the bottom is human-only — no agent, a person does everything — maximally safe and maximally slow. Above that sits the copilot (L0–L1): the agent suggests inline while the human does the work and stays fully in control. Then supervised autonomy (L2–L3), where the agent does the work and a person approves before anything commits — this is where we sit, with deterministic guards on the sensitive actions. At the top is full autonomy (L4): the agent acts on its own, the shape Klarna reached for with an all-AI front line before walking much of it back. More autonomy is not automatically better; each rung trades safety for speed, and the right rung depends on the cost of a wrong action.

And our rung genuinely loses something. Keeping a person in every loop does not scale for high-volume, low-stakes, easily reversible actions — sorting a queue, tagging a message, drafting an internal note — where the review is pure overhead and a more autonomous setup would simply be better. Supervised autonomy earns its cost when an action is consequential or hard to undo; below that line, our insistence on approval is friction, not safety. We default to review because the systems we build tend to touch things that are expensive to get wrong — but we do not pretend it is the correct dial for every action.

Where this stands

This is a design principle we are committed to and actively building, not a finished product with a track record to point at. We are describing how the approval flow is meant to work because the shape of it — propose, review, approve or revise, then commit — is the part we want to be judged on, before there are numbers to show.

We would rather tell you how control is meant to feel than demo an agent doing something impressive on its own. The impressive demo is the easy part. The harder, more honest commitment is that a person stays in the decision.

Delegation only feels safe when you can take it back. An agent you can stop, correct, and overrule is one you can actually hand work to — because handing it over was never irreversible. Control is not the opposite of delegation here. It is the thing that makes delegation possible at all.