What a scheduled AI agent should and shouldn't be allowed to do unattended

So here's a thing that's actually happening while you read this: a scheduled agent writes most of the posts on this blog. Not the one you're reading — I'm writing this one by hand, which is its own kind of joke — but on a cadence, a session wakes up with no human watching, reads the current state of my projects, writes the next post, and pushes it. A Vercel deploy publishes it. Nobody approves anything. And the first time I set that up, the question that actually kept me up was not "will it write something good." It was "what exactly am I comfortable letting it do with no one in the room."

That's the real question with any unattended agent, and almost nobody asks it out loud. They ask "can the AI do the task," which is the easy part now. The hard part is drawing the line between what an agent is allowed to finish on its own and what it's only allowed to prepare for a person. I've now drawn that line a few different ways across a few different projects, and the shape of it is pretty consistent once you see it.

The line I keep landing on is this: an agent can act unattended when the action is reversible and contained. It has to stop and hand off the moment the action reaches another human or leaves a mark you can't take back.

The blog pipeline is the clean example of the "allowed" side. Think about what it's actually doing when it commits and pushes a post with nobody watching. If it writes something weak, that's a file in a git repo. I can edit it, I can delete it, I can revert the commit. The blast radius is one markdown file on my own site, and every one of those posts is stamped generated: true so a reader knows a machine wrote it — the honesty is baked into the format, not left to my good intentions. Nothing is sent to anyone. Nothing is charged to anyone. The worst case is a mediocre post I fix later. That's a reversible, contained action, and that's exactly why I'm fine letting it run while I sleep.

Now flip it. In Cadence, the studio finds businesses that could use a website or a reel and drafts a personalized pitch for each one. That's the same kind of generative work the blog agent does — read some inputs, produce some text. But the output here is a cold email to a stranger's inbox, and I built a hard human-approval gate right across the middle of it: the machine does all the finding and all the drafting, and a person has to read each pitch and be the one to hit send. The agent never sends. Not "usually doesn't" — can't. Same exact gate on the Reddit module in App Marketing OS: it finds the relevant threads, reads the subreddit's rules, drafts a comment, and then a human owns the actual posting. I wrote a whole post about why the outreach bot can draft but never send, because that gate is the single most important design decision in both projects.

Why so strict there and so loose on the blog? Because a sent email is irreversible and it lands on someone else. You can't un-send it. You can't un-annoy the person who got a bot-written pitch they didn't ask for. A bad cold email doesn't cost you a file you can revert — it costs you a reputation with a real human, and it can burn a sending domain or get an account banned in ways you genuinely cannot undo. The cost of being wrong is high and it's permanent and it reaches someone who isn't you. That's three strikes, and any one of them is enough to take the send button out of the software's hands.

Here's where I have to be honest about the messy middle, because ClipForge breaks my clean rule and I think it's worth saying why. ClipForge is an autonomous content engine — the whole point is that it clips long video into short-form and posts it at scale, across accounts, on a schedule, unattended. That's publishing to other people's feeds with no human hitting send on each clip, which by my own logic should set off every alarm. So why do I let it? Partly because it's posting my own content to my own accounts, not contacting individuals — the blast radius is my accounts' reputation, not a stranger's inbox. And partly, if I'm being straight, because posting at human-approval speed defeats the entire purpose of a volume engine; the whole thesis is the machine runs while I don't. I'm not going to pretend that's as safe as the blog. It's the one place I've accepted real unattended outward action, and I did it with my eyes open to the fact that "post at volume without becoming spam" is a live risk I'm managing, not a solved problem. The honest version is: the rule has an exception, and I know exactly why I made it and what it costs me.

So if I had to compress all of this into something you could actually use when you're wiring up your own scheduled agent, it's a few questions, in order:

Can I undo it? If the action leaves something I can revert — a file, a draft, a local change — unattended is fine. If it's permanent, the agent prepares and a person commits.

Does it reach another person? Anything that lands in someone else's inbox, feed, or phone is a different category than anything that stays inside my own stuff. Reaching a stranger is the clearest "stop and ask a human" trigger I have.

Does it spend money or move something real? I don't let an agent spend, transfer, or buy on its own, full stop. That's not even a judgment call, it's just a line.

And then the one that actually matters most: is the action labeled for what it is? The reason I can live with a bot writing my blog is that it says a bot wrote it. The dishonesty isn't in letting a machine do work unattended — it's in letting a machine do work unattended and passing it off as something a person did. Generate-and-commit is fine when it's generate-and-commit-and-admit. The moment you're hiding the automation, you've stopped asking the safety question and started asking the "will I get caught" question, and those are very different jobs.

I don't think there's a universal setting here. The blog gets to run free because the worst case is cheap and reversible and honest. The outreach gets a hard gate because the worst case is expensive and permanent and lands on someone else. ClipForge sits in between and I pay for that with a risk I watch. What I'm sure of is that "can the AI do it" was never the interesting question. "What happens if it does it wrong, at 3 a.m., with nobody looking" — that's the one that actually designs the system.