AI Agents Can Act. A Person Should Still Approve the Work

Business owners keep hearing that an AI agent can build the website, answer customers, and write the code. Some of that help is real. The part that gets skipped is a person checking the work. This is what that kind of tool is, why it needs limits, and what to ask before someone uses one for your business.

An agent does not only suggest. It acts.

An agent, in this use of the word, is software that can take actions. It does not stop at a suggestion. It can write code, change files, and send things. A chat window that only answers a question is not the same tool. An agentic tool is one that is allowed to do the next step itself.

That speed is the appeal. A draft can wait until you like it. An action can publish a page, email a customer, or change a login before anyone has read it.

Why guardrails matter

A guardrail is a limit you put on the tool before it acts. You need one because an agent can move fast and be confidently wrong. The words can sound sure, and the code can look finished. Neither means the result is safe or what you asked for.

A wrong paragraph wastes a few minutes. A wrong action can show private information, send a message you did not approve, or spend money. The tool will keep going unless something, or someone, stops it.

OWASP's 2025 Top 10 for LLM Applications includes a risk it calls Excessive Agency: giving an automated system too much freedom to take actions. NIST's AI Risk Management Framework is a voluntary guide for governing AI and keeping a person responsible. Neither one is a certificate, and neither one makes a product safe by itself.

A person stays in the loop

Human in the loop means a person stays on the path of the important actions. The agent can gather notes, draft a page, or prepare a code change. A person decides what is allowed to go out. The tool does not get the last word on anything a customer will see, anything that spends money, or anything that cannot be easily undone.

Practical guardrails

• A person approves anything that goes live, sends a message, or spends money. The agent can prepare it. It should not publish, email, or pay on its own.
• Changes go through a review, with a preview link, before publishing. Someone looks at the real pages before they replace the live site.
• The agent gets only the access it needs, and secrets stay out of the code. Passwords and private codes do not belong in the page or in a file a visitor can download.
• Automatic security scans run on changes. A scan looks for common mistakes. It does not replace a person.
• You can roll back to the last good version if a change is wrong, without rebuilding the site from memory.
• There is a log of what the agent did: which files changed, what was sent, and when.
• There are limits on what it may do without asking. Writing a draft is different from publishing, deleting, or messaging customers.

Questions to ask anyone building with AI for you

You do not need to learn the software. You do need direct answers.

• Who approves what goes live?
• Can it send a message, or spend money, without a person saying yes?
• Where is the preview link before something is published?
• What is the agent allowed to open, and where do the passwords live?
• Do changes get an automatic security scan?
• Can you roll back to the last good version?
• Is there a log of what the agent did?
• What is it not allowed to do without asking?

If the answer is that the AI handles it, ask who checks the result. "I am not sure" is a reason to slow down.

On October 20, 2026, ITWeb reported that the South African coffee chain Bootlegger had an internal dashboard expose data across 132 stores. The CEO had publicly championed building apps with AI. The dashboard's login screen did not actually protect the data behind it. Bootlegger has not confirmed that AI built that dashboard. This article does not claim that it did. The longer write-up is DIY AI Websites Look Done. Are They Safe?. More on certificates, passwords, and backups is in Website Security Basics for Small Businesses and Clinics.

How D3 handles it

D3 uses AI agents to help with research, drafting, and code. Here is what we have in place today:

• JD reviews and approves changes before they go live. Every website change gets a preview link first.
• Nothing gets sent to a client or customer without JD's review.
• Agents cannot create accounts, spend money, or publish on their own. Those steps wait for JD.
• Passwords and private keys stay out of the code and out of shared documents.
• Automatic security scans check code changes for leaked secrets, known vulnerabilities, and common mistakes, and a security review runs every week.
• Every change is logged, and the live site can roll back to the last good version.

We are always looking for ways to improve these guardrails as the tools change.

Want help building with AI the careful way? Talk to JD on the contact page.