01 / The problem
The risky click.
A commercial operator can reconcile a pipeline, identify overdue follow-ups, research a company, prepare a draft and summarise what needs attention. Those repeated preparation tasks consume time but do not all carry the same consequence.
Sending an email, publishing a post, booking a meeting or making a commercial promise is different. Those actions represent the business to another person. Treating every step as one broad permission would make the system simpler to describe and harder to trust.
02 / The boundary
Separate authority.
The operator I built can perform routine internal work: read approved systems, research public evidence, maintain permitted pipeline state and prepare review-ready drafts. It cannot send email, publish, comment, connect, direct-message, submit a form or change a meeting.
Pipeline, messages, calendar and bounded public research.
Classification, prioritisation, records and review-ready drafts.
Send, publish, book, commit or change strategy.
The point is not to make the agent passive. It should resolve routine work independently inside the boundary. The point is to make the consequential edge explicit.
03 / Sources of truth
Facts need owners.
The pipeline owns prospect state. Email owns replies, bounces, opt-outs and drafts. The calendar owns booked-meeting evidence. Official public sources support company facts. Reviewed policy outranks memory and model judgement.
This matters because a fluent summary is not authoritative evidence. If a source is unavailable, the system stops the affected work instead of inventing continuity.
04 / Failure behaviour
Fail closed.
Public research has explicit request and page budgets. Pipeline mutations use guarded commands and duplicate checks. Draft creation stops when a thread already contains a draft or when a reply, bounce, suppression or opt-out changes the state.
When evidence, credentials or an authoritative system is unavailable, the correct result is less work and a clear reason. It is not a plausible substitute.
The repository contains reviewed policy and deterministic checks, not raw leads, message bodies, credentials or generated run output. Runtime information stays in the systems that own it.
05 / The lesson
Before the click.
There is a false choice between manual work and an autonomous agent. A bounded operator can remove research, reconciliation and drafting overhead while leaving the relationship and final judgement intact.
That boundary also improves evaluation. The system can be judged on whether it found the right evidence, maintained the right state and prepared a useful next action, without pretending that sending more messages is success.