The controls
Where a person has to say yes.
An agent you cannot supervise is a liability, not a teammate. This is the full list of gates, and underneath it the three places work happens without one.
What the agent produces
What has to happen next
Scope
A task the AI offers to do
Approve it, decline it, or answer the question it asked — on the task itself.
Per task
A suggested action on an email
Accept or dismiss it on the message. Or clear every “file it / nothing to do” suggestion in one go.
Per message, or in bulk
Something in the spam quarantine
Confirm it, release it, or release it and allow that whole domain in future.
One, or a whole page
A thread you handed over
It comes back marked awaiting review. Complete it, or send it back for another go.
Per thread
A send that looks wrong
Held on a verify page until a person fixes the address, sends it anyway, or bins it.
Per message
Work sent to one of your own machines
Three separate account switches, all off until somebody deliberately turns them on.
Per account
Any bulk operation
A restore point is taken before the change, so the whole thing can be put back.
Per operation
And the three exceptions, because you would find them anyway. Mail the AI has classified as junk can be filed or deleted without a click — but only if you switch that on. An agent on one of your own machines, once you have enabled task creation, creates real tasks without review (rate-limited by the hour and by the day). And a connection you have deliberately set to “post” rather than “propose” publishes straight away. Everything else proposes first.