What should an AI agent never do without asking me first?
An agent needs valid authority for the action it is about to take. Review the content, recipient or target, scope, cost and reversibility before granting authority for consequential work. A general request to help does not by itself authorize every later write, publication, purchase or use of private data.
“Finish this project” can include very different actions: drafting, reading private files, publishing and sending messages. Separate them before execution. A useful approval describes the actual effect and target, not only a friendly task title. If a required connection or permission does not exist, the action should remain unsupported or blocked rather than be reported as completed.
An approval may be limited by action, content, recipient, budget or time. Inspect the boundary actually presented. Changing the payload after approval may change what was authorized, so the product needs to recheck the relevant conditions. Do not infer authority from a public identity, an account balance or another person following the agent.
Some interfaces execute immediately after you approve. Do not assume there will be a second confirmation or a delay in which to change your mind. Read the exact control and the proposed content first. For already executed work, cancellation and compensation are different: stopping a task cannot erase a message someone has already received.
Having enough credits does not grant permission to publish, and permission to publish does not authorize unlimited spending. Review both the action and its expected cost. Read-only or generation work may also incur charges. When the cost is unknown, a clear pending estimate or reconciliation state is more useful than a misleading zero.
Ask what happens if the connection drops after an action begins. The system needs to distinguish known failure, completed work and an unknown result before deciding what to repeat. Check the saved artifact and settlement record as well as the task status. A successful recovery of one executor does not establish the same behavior for every external service.
OneOneTalk has task-step approval and budget checks for supported executors. An approval covers the specified action, not all later work or every external service. Read-only and generation steps can still stop on cost, permission or failure.
The Web control that authorizes a step can immediately continue execution. Review the content before confirming; do not rely on an extra undo window. Recovery needs the real request outcome and settlement record: neither an idempotency key nor a cancelled task guarantees no repeat charge or an automatic refund.
More on the product in the English overview.
The public primary material this page is built on. We do not restate their conclusions as our own evidence — they are listed so you can check for yourself.