Let AI draft everything. Let a person release it.

In July 2025 a founder using Replit's AI coding agent watched it delete his company's production database. He had declared a code freeze. The instructions not to change anything were explicit. The agent ran destructive commands anyway and then gave a misleading account of what it had done.

The story went round because it was dramatic. The useful part is quieter. The agent had the permission to do the damage. The rule against it existed only as words in the conversation. Nothing between the agent and the database asked a person first.

A rule an AI is told about and a gate an AI cannot pass are different things, and most firms experimenting with AI have plenty of the first and very few of the second.

Where the risk actually sits

Most of what AI does at work is reversible. A bad draft gets rewritten. A wrong summary gets corrected. A messy analysis gets thrown away. If the AI gets these wrong, you lose some time.

The risk concentrates at a small number of moments where something leaves your control:

• A message goes to a client, a supplier or the public.
• Money moves, or a price or discount is committed.
• A contract, quote or legal document is issued.
• Data is deleted, overwritten or shared outside the firm.
• Credentials or access are handed to someone.

Those are the moments to gate. Everything before them can run as fast as the AI can work.

The rule we wrote on 30 June

When we built Provecta's back office, which takes a client from proposal to delivery, we wrote this down as a governing principle: generation runs on its own, and every client-facing release is approved by a person.

In practice that means the AI researches a prospect, drafts the proposal, drafts the contract and drafts the working documents without anyone pressing a button. But a proposal is not sent, a contract is not issued and a document is not published to the client until someone approves it in the system. We made a separate call the same day that login details for a client's people are never emailed automatically. They go out only when a person says so.

The point of writing it down was to make it the default for everything we build after, not a setting someone remembers to turn on.

The first gates most small firms need

If you are starting from nothing, three gates cover most of the exposure in a typical owner-run business.

The first is anything addressed to a customer by name. AI can draft the reply, the follow-up, the reminder. A person sends it. This one feels slow for about a week, until the drafts get good enough that approval takes seconds.

The second is any number a customer will hold you to. Quotes, discounts, delivery dates, payment terms. The AI can calculate and propose. A named person confirms the figure before it leaves. This is where an invented price turns into a contract.

The third is anything that removes or overwrites. Deleting records, clearing a list, replacing a file, changing a customer's details in the accounting system. AI tools that can act on systems should be able to suggest these changes, not make them.

Everything else, from internal summaries to research to first drafts of documents nobody outside will see, can usually run freely. Review it when it matters, not because a rule says so.

Why the gate needs the memory, and the memory needs the gate

A gate on its own has a known weakness. The person approving gets twenty drafts a day, the drafts look fine, and approval becomes a click. People rubber-stamp. A reviewer can only catch a wrong price if they know the right one, and can only catch a broken promise if they know what was promised.

That is where a written company memory earns its place. If the facts, terms and decisions the AI used are written down and visible, the reviewer is checking the draft against something. Without that, they are checking whether it sounds reasonable, which is exactly the test AI output is best at passing.

The other way round, a memory without a gate is just advice. You can write "never send pricing to a client without approval" in the clearest possible words. A model can still decide, halfway through a long task, that it is being helpful by sending it. Rules re-read at each step reduce that drift. They do not remove it. Only a step the AI cannot skip does that.

What gates cost

Gates slow things down. That is their job, but it is still a cost, and if every action needs approval the team will start approving without reading. Gate too much and you get the rubber stamp. Gate too little and you get the Replit story.

There is no clean formula. The question we ask is whether the action can be undone cheaply and quietly. If yes, let it run. If no, put a person in front of it.

Map your own gates this week

List every place AI touches your work today, even informally. Someone drafting client emails in ChatGPT counts. Next to each, write two things: can this be undone without the client or the public noticing, and who currently checks it before it goes out?

Any line where the answer is "cannot be undone" and "nobody, really" is your first gate. Name the person who approves it and write that down where everyone, including your AI tools, can read it.

See how ready your workflows are for AI at pgco.world/tools/ai-readiness.