Drafts not sent

Autonomy without a human gate is theater.

The demo rewards speed. The agent drafts the reply, fills the fields, and “finishes” the job in one take. The room nods. Production is the same path with worse stakes: a stranger gets the email, money moves, or a system of record changes in a way you cannot quietly undo.

If your pilot can auto-send those actions, you did not ship an agent. You shipped a liability with a confident tone.

Drafts not sent is the first useful rule.

What must never leave without a yes

Write the irreversible list before you pick a model.

1. Outbound contact. Email, SMS, or chat to people who did not ask. A draft in a folder is work. A send is a commitment.
2. Money movement. Charges, refunds, payouts, credit changes. If it hits a ledger, it waits.
3. Production writes. CRM stage changes, ticket closes, invoices, calendar invites, approved documents, permission changes. Reads and internal drafts can be freer. Mutations need an owner.

Those three are enough for version one. You can refine thresholds later. You cannot retrofit honesty into a system that already emailed the wrong customer.

Propose, then approve

The useful shape is boring on purpose.

The system proposes. A named person sees the proposed action, the source of the data, and a one-line reason. They approve, edit, or refuse. Silence has an owner and a timeout, not an infinite wait that pretends to be oversight.

That is the same rule we use on outbound work and on ResearcherFlow writes we run ourselves: propose, then approve before anything becomes the durable record. The gate is not a slide about “human in the loop.” It is a product behavior you can point at.

Name the three exits on the irreversible step

Happy-path demos hide the cases that matter. Before the recording, label what happens when the case is not clean:

1. Skip. Incomplete or out of bounds today. Park it. Do not invent a send to fill the gap.
2. Ask a human. Plausible but ambiguous, high-stakes, or judgment-heavy. Route a short question. Wait.
3. Refuse. Unsafe, out of scope, or underspecified for an irreversible action. Stop. Say what is missing.

Those exits keep the success number honest. Count completions next to skips, asks, and refusals. A system that sends less often but sends correctly is more useful than a system that “succeeds” by guessing past the gate.

One painful workflow, not a mega-chat

Staff one bot with one job. Status rebuild. Triage. Draft packet. Pick the recurring pain where an irreversible step already exists, and put the checkpoint there.

Shrink until one owner can review a queue in minutes. New surfaces wait for version two. Agents and productized automations when a bounded workflow is enough. Custom software when the workflow will not fit a template.

How we use this at Viking Labs

We treat drafts-not-sent as part of version one, not a backlog item labeled “add approvals later.” ResearcherFlow is one production proof: live billing, permissions, and human gates on writes. Client work follows the same pattern. Before the first demo we ask: what must never auto-send, who owns the yes, and what do we skip, ask, or refuse?

The impressive part of an AI system is not a clean recording of an auto-send. It is a finished job with an owner, a success number someone checks, and irreversible steps that stayed drafts until a person said yes.

That is what we build. If you have one painful workflow that still ends in a send you would not defend, map the first build: tell us the workflow

Optional proof product (same studio gate, science lane): https://researcherflow.com

Jon Marrs · About Viking Labs