What rules should AI follow once it can act in my business?
Guided by Otto, written by Something Clever Co., updated
Once AI can do things in your real tools, not just suggest them, you need a few plain rules: what it is allowed to touch, where a person checks its work, how you find out when something goes wrong, and what it is allowed to spend. They can be simple. If AI only drafts things a person then sends, you barely need any.
Why this question keeps coming up
Most businesses start with AI the same way. Someone signs up for ChatGPT or Claude, writes a few emails, and gets a little faster. Then the ideas get bigger. What if AI answered leads, updated the CRM, chased late payments or wrote the weekly report?
That is where things get uncomfortable. The moment AI can act, not just suggest, you need answers to some plain questions. What is it allowed to touch? Who checks its work? What happens if it makes a mistake at 2 a.m.? How much is it costing? Writing those answers down is all “rules for AI” really means.
Four things to decide
- What it can touch. Give each automation access to only the tools it needs. One that reads your calendar should not be able to send invoices.
- Where a person checks. Pick the points where someone looks before anything goes out or changes. Anything customers see or money touches is a good place to start.
- How you hear about problems. Decide who gets told when something stops working or looks odd, and how.
- What it can spend. If a tool is billed by usage, set a spending limit in that tool so a bug can’t run up a bill overnight.
How much should AI do alone?
For each job, pick one of three:
| Setup | What the AI does | What a person does | Typical example |
|---|---|---|---|
| AI suggests | Drafts or suggests | Takes the action | AI drafts a reply, you send it |
| AI does, you approve | Does the work | Says yes before it goes out | AI updates the CRM, you approve the update |
| AI handles it | Acts on its own on routine work | Checks in on a schedule | AI tags and files routine requests |
Start new jobs with a person approving. Loosen it only when the AI has a track record and a mistake would be cheap. Some jobs should always keep a person, and that is fine.
Why each rule matters
Checks catch mistakes before customers see them. AI can be confidently wrong, and a quick look from a person is cheap insurance.
Keeping a record of what the AI did turns “I think it did something weird last week” into a clear answer. Many tools keep one already. Make sure someone knows where it is.
Spending limits stop the classic failure where an automation loops or retries and quietly runs up a bill.
Limited access means that even if something goes wrong, the damage stays small.
When you do not need any of this
If AI in your business means a few people using ChatGPT to draft things they then edit and send themselves, a person already does every action. Write a short note about what not to paste into chatbots (customer data, passwords) and move on.
You need real rules when AI starts taking actions in your real tools: Gmail, HubSpot, QuickBooks, Stripe, Slack, your website.
Common mistakes
- Going straight to full automation. Start with a person approving, then loosen it once you have a record.
- One shared login for every AI tool. Give each automation only the access it needs.
- No spending limit. AI billed by usage can surprise you.
- No record of what happened. If you cannot trace an action, you cannot fix the cause.
- Treating it as a one time setup. Tools and risks change. Look again every so often.
- Removing people entirely. Decisions that take real judgment still belong with a person.
