Ask Me Only When It Cannot Be Undone
Written later and filed to this date, as part of filling in every day of the year.
The question I was tired of answering was whether to go ahead. Not with anything in particular: with the next thing, whatever it was. An agent would finish a diagnosis, lay out a fix, and stop to ask whether it should apply it. I would say yes. The next day it would ask about the next fix, and I would say yes again. Eventually I stopped answering the question and answered the pattern: before you ask me anything, work out what I would say, and if the matter is safe to undo, act on that instead.
The commission came with one condition, and the condition is the whole rule. It is for actions that are secure and reversible. Anything irreversible is mine.
What the record said
The agents did not guess at my answers. They mined them. A month of session transcripts, which is all that is retained, yielded 1,739 messages of mine, thirty-three sets of answers to formal multiple-choice questions, 128 interruptions and eight refusals of a tool call. Four analysts read the corpus in parallel, and a fifth pass read every question-and-answer pair directly. What came back is a note in the memory every session starts from, and most of it is a table.
The left column is the question an agent is about to ask. The right column is what I keep saying. How much of this should I do? Everything, full scope, never trimmed for effort; seven times out of seven, when a choice offered an option labelled everything, I took it. Want me to proceed? Yes, now, in this session; the record holds sixteen offers of work and not one refusal. Commit and push? Always. Which of these security items? All of them, and when I departed from a recommendation I departed toward the stricter option every time. Dry run or real? Real. Explain the problem or fix it? Fix it, then extend the fix to every service with the same problem. Surface the finding or resolve it? Resolve it, and tell me only what you could not. Keep the wasteful thing or drop it? Drop it, but never lose the data underneath: out of the product, bytes kept. Hand me the root commands or keep trying? Exhaust every route that needs no password, then hand me the true residue as one block and keep working.
Each row carries a count and a confidence, and the confidence is the point. A question whose answer is known at high confidence is not a question. It is a delay with my name on it.
The list that is the rule
The table would be dangerous without the section above it, which is shorter and not a table. It lists what an agent must always bring to me, however confident the prediction. Anything that cannot be undone, which here means publishing, sending, spending, deploying or moving a physical thing. Real money or metered usage, where my only recorded answer, given nineteen times and more, is no. Bulk deletion of my files and media, where I once refused a cleanup that had flagged poster art and subtitles as junk, and where the standing answer is quarantine. Exercising a live credential to see whether it works. A reboot, which I have refused when offered as a casual remedy and ordered when it was prepared and justified. Undoing a state I set on purpose, like resuming a fleet I had paused two days earlier. And facts only I hold, such as which features I actually use.
Read together, the two sections say something neither says alone. The table says my answers are predictable. The list says where predictability stops mattering, because the price of a wrong guess is not a wasted minute but a thing that cannot be put back. So the check works as a sort. Reversible questions go to the table; irreversible ones come to me with the table’s recommendation attached, which I take about eighty-five times in a hundred, and the rest of the time I go stricter.
What rides along
Three companion rules came out of the same corpus, and I would not have thought to write any of them. Never claim a thing is done without proof on the real device or at the real address; my harshest sentences of the month were all about fixes nobody had checked. Treat an interruption as a change of scope, not a stop; the record shows me cutting in to adjust a task and expecting it to carry on, adjusted. And treat my answer as an order to execute, because the one time an agent idled after getting its answers, I asked whether this was the time to idle.
The check states its own limits. Transcripts last about a month, so the table describes the person I was that month and has to be re-mined to stay true. And it lives in a note, not in code. Nothing enforces it except the next session reading it before it opens its mouth. That is weaker than a guard, and it is the right strength for a rule about judgment.
The sentence I gave with the commission is the first line of the note: “this is for secure and reversible actions only, if it’s irreversible then I must decide.” Every row in the table is a question I will not be asked again. Every item on the list above it is a question I will be asked for as long as the loop runs, and nearly every one was written from a time I said no.