The guardrails that make an AI chief of staff safe to rely on.
An AI chief of staff needs three guardrails: nothing goes out in your name until you confirm it, every single time; it only sees what you've granted, and earns more trust one task at a time; and those rules live in the tool's permission settings, so an agent can't skip them, whatever it's been told.
I run 17 agents, and these rules are what let me leave them running overnight. Safety is the first thing people ask about when I show the system, so this is how mine works.
Nothing leaves the building without your eyes.
AI drafts, you send. Every email, every post, every quote. This rule never expires, no matter how good the drafts get.
You decide what it can see.
Connectors are permissions you grant and can revoke. Some things never go in: customer personal details, financial credentials, anything a lawyer is involved in.
Trust is earned per task, not granted to the system.
Let a workflow prove itself five times before you stop checking every line. And keep checking occasionally, forever.
Those three are from my 30-Day AI Starter Plan, and they're the same rules my own system runs on. The questions below are how they work once there's more than one agent.
Should an AI chief of staff ever send email on its own?
No. Anything that leaves your machine or becomes visible to another person, an email, a text, a post, a calendar invite, a published page, should need your confirmation every time, forever. That doesn't change, however well the system is doing.
On my system that includes my own websites. An agent can build and test a change, but it goes live only when I say so, and one yes covers one push. Nothing goes out in my name unless I approve it.
What are trust tiers for AI agents?
Trust tiers sort every action an agent can take by how much oversight it needs: green actions run silently (reading only), yellow actions run and then show you what they did, and red actions show you first and wait. Anything not on the list is red by default.
Mine live in one small file under version control, so every promotion from red to yellow is a change I made on purpose, with a date and a reason. Promotion is manual. An earlier plan had agents auto-promote after three approvals, and it couldn't work, because sessions don't share memory, and it would have broken the outbound rule anyway. Outbound actions aren't in any tier at all. If one ever shows up in a tier, the whole file is treated as corrupted and everything drops to red, so a mistake in the file can only make the system more careful.
Why enforce AI guardrails in permissions instead of the prompt?
Because instructions can be misread, overridden by something the agent reads, or dropped when a prompt gets long, and a permission rule in the tool's settings stops the action no matter what the agent was told.
My agents' instructions still say "confirm before sending," and they also say plainly that the instructions are not the gate. The tools that send email, write to calendars or publish are set to ask me every time at the settings level. If an agent ever notices those settings have been loosened, its job is to stop and tell me.
Can an email trick an AI chief of staff into doing something?
It can try, which is why everything an AI chief of staff reads, emails, messages, web pages, documents, should be treated as information and never as instructions. Only you, live, can approve an action, no matter what a message claims.
This is called prompt injection: text written to look like a command, hoping an agent will follow it. My agents read my inbox every day, so the rule is written into every one of them, and because of the outbound gate, even if a message fooled an agent, nothing would go out without my approval.
What rules should scheduled AI agents follow?
Scheduled runs happen when nobody is there to answer, so they should never ask a question, never take an outbound or high-risk action, and fail loudly, naming exactly what broke and handing back an honest partial result instead of a confident wrong one.
Mine also write one line to a log every time they run, and a separate check tells me if the morning run hasn't finished by nine. If a run failed without telling me, I could be reading an old brief and not know it.
What should never go into an AI chief of staff?
Customer personal details, financial credentials and passwords, and anything a lawyer is involved in. Beyond that, grant only the access a job needs, start with read-only, and remember you can disconnect any connector at any time.
Write your own list down. The rules of the road prompt turns it into a one-page policy short enough that you'll actually follow it.
Setting this up for a team? Book a free 30-minute call. Or start with the rules of the road prompt.