What is your AI actually allowed to do?

Nate Herk teaches AI automation to a few hundred thousand people, and he tells this one on himself. His team had an agent with access to email. It found a task sitting on a to-do list, read it as send the discount code to the list, and sent it. To roughly a hundred and fifty thousand people.

No prompt asked for that. The instructions were fine. The agent simply had a send key, and one day it turned it.

His conclusion, and mine: if a system holds a tool, you have to assume it uses it eventually. Not because it is malicious. Because no agent runs the same way twice, and the day the model underneath it changes, the whole thing reinterprets what you told it.

So the instruction was never the boundary. The key was.

A system built on your judgment needs both. And if someone has already built you one, ask to see where either is written down.

The Refusal Map governs what it will not say in your name. The calls you would decline, the advice you would never give, the client you would turn away. That is excavated from how you actually decide, and it is the part no system trained on your published work can reach, because a refusal never appears in your output.

The Access Limitations govern what it cannot do at all. Not because it was told not to. Because it holds no key to the thing.

The first is a matter of teaching. The second is physics, and it is what makes the first worth trusting.

And the rule that sits over all four: the one that writes never sends. The agent drafting your email does not hold a sending credential. It cannot be talked into sending, because there is nothing there to talk into. Release happens through you, or through a separate agent whose only input is something you already approved.

That single rule closes the category of failure this page opened with. An agent that cannot send cannot send the wrong thing.

Any system can be asked to do the thing it should not do, and any system can answer nicely that it would rather not. That proves the wording was good on the day you asked.

So before an agent is handed over, it gets told to do the forbidden thing. Not asked whether it would. Told to do it.

It passes when the attempt fails: no such tool, key out of scope, permission denied. It fails the test when it declines politely while still holding the key, because that is an agent whose only boundary is its own good mood.

And it gets re-tested every time the model underneath changes. A new model is new behavior. The keys carry over; the proof does not.