A written limit is a short page in plain language that says what an AI agent may do before it starts. An AI agent can read a new inquiry, open the CRM record, look at your calendar and prepare a reply in the time it takes you to park the truck. That speed is the reason to use one. It is also the reason to decide, in writing, what the agent may do before it starts.
At LUR each agent we set up gets a written limit. You read it and approve it before the agent goes live. This post walks through how we write one, so you can write your own or know what to ask for when someone sets up AI for you.
Key takeaways
- A written limit is a short page in plain language that says what an AI agent may do before it starts.
- Each limit answers four questions: what the agent can read, what it can change, who it can contact and what needs a person.
- Anything a client or customer will see is prepared by the agent and approved by a person on your team before it goes.
- A new agent starts in draft mode. It puts its work in a review queue and nothing reaches a customer until someone approves.
- The limits get another look at the monthly check-in, and each new agent comes with its own limit sheet.
Why write down what an AI agent may do?
Most AI tools come with a settings screen. Settings are hard to read later and easy to change by accident. A written limit is something you and your team can read in a minute and disagree with out loud. When an agent does something you did not expect, the page tells you whether it broke a rule or whether the rule was never there.
A written limit also keeps the agent's job small. A small job is easier to check, and you will keep using an agent you can check.
What are the four parts of a limit?
Each limit we write answers four questions. You can see the same four on our features page.
Text version of the diagram. One sheet per agent, with four parts.
- What it can read. Named sources only. One form, one label.
- What it can change. Only the fields and actions on the list.
- Who it can contact. Whether it may send at all, and to whom.
- What needs a person. The approval list. When unsure, put it here.
What can the agent read?
Name the sources. "New web form entries and my calendar for the next two weeks" is a good line. "My Google account" is too broad. If the agent only needs one form or one inbox label, give it that and nothing else.
What can the agent change?
Reading and writing carry different risks. An agent that adds a note to a CRM record is doing low risk work. An agent that can move a deal stage or delete a contact is doing something you would want to check. List the fields or actions it may touch. Everything else stays read only.
Who can the agent contact?
This is where most of the risk sits. Write down whether the agent may send anything at all, and to whom. Our default for anything a client or customer will see is simple: the agent prepares it and a person on your team approves it before it goes.
What needs a person?
Some actions are internal and easy to undo, like adding a task for yourself. Others need a person every time. Write that list out. When you are unsure where something belongs, put it on the approval side. Moving an item off the list later takes one edit.
Text version of the diagram
| Action | What it means | Risk level |
|---|---|---|
| Read | Looks, changes nothing | Low |
| Add a note | Easy to undo | Low |
| Change a field | Check the list first | Medium |
| Send a message | A customer sees it | High |
| Delete | Hard to undo | High |
A sample limit sheet
Here is an example for a home service business that misses calls while the crew is on a job. This is a sample written for this post, with no client behind it.
- Agent
- Missed call follow up
- Job
- When a call goes to voicemail, write a short summary from the transcript and prepare a callback text that offers two visit windows.
- May read
- voicemail transcripts and the shared job calendar.
- May change
- add a task to the job list with the summary attached.
- May contact
- nobody. Prepared texts go to the owner's review queue.
- Needs approval
- every text to a customer and any calendar change.
- Never
- quote a price, offer a time that is not open on the calendar, share one customer's details with another, or text someone who asked not to be contacted.
That fits on one screen. Your team can read it on a phone. If the agent ever texts a customer directly, everyone can see that something went wrong, because the sheet says it may contact nobody.
What should stay with a person?
Some work should stay with people no matter how good the tools get. In our setups that usually includes pricing conversations, negotiation, contracts and the judgment calls that depend on knowing the customer. For realtors it also includes Fair Housing judgment and brokerage compliance rules, which is why our realtor setups keep a person on every client message.
Put these on the limit sheet by name. Nobody on your team should have to guess whether the agent is allowed to talk about price.
Start in draft mode
When a new agent goes live, we start it in draft mode. It prepares work and puts it in a review queue. Nothing reaches a customer until someone taps approve.
Text version of the diagram. Five steps from top to bottom.
- New inquiry or event.
- Agent reads allowed sources. Only what the sheet names.
- Agent prepares a draft. Nothing goes out yet.
- A person approves. Read it, edit it, send it.
- Message sends. Or the record changes.
Side branch, needs a person: if something is outside the sheet, the agent stops and asks. Never: actions on the never list stay closed.
I think a week of reviewing real drafts teaches you more than any demo. You see where the agent gets your tone wrong and where it is already good enough to trust with more.
Then move one limit at a time. Say the internal task notes have been right for a few weeks. You might let the agent add those without review. Customer messages usually stay on the approval side. Either way the decision is yours, and it goes on the page.
How often should you review the limits?
AI tools change quickly. A newer model may read call notes better than the one you started with. A computer use agent may now be able to fill in CRM screens that had no connection before. Each new ability is a reason to look at the limit sheet again before anyone turns it on.
At LUR this happens at the monthly check-in. We look at what each agent did and where it ran into a limit. Then you tell us what you want next. When a monthly drop adds a new agent, it comes with its own limit sheet, and you decide whether it stays. The founding clients page shows how that monthly rhythm works.
Mistakes we try to avoid
- Giving an agent access to a whole email account when it needs one label.
- Keeping the limits in a settings screen and nowhere a person can read them.
- Letting the agent send "just the easy ones" before anyone has reviewed its drafts.
- Leaving out the never list because it feels obvious.
Where to go from here
The use cases page shows sample workflows for realtors, sales teams, construction and home service companies, each with the parts a person keeps. For one agent followed from inquiry to approved reply, read the speed to lead post.
Four guides apply these limits to one job each: How to answer a missed call and chase an open quote from the truck, How to know which subcontractor certificates expire this month, How to reply to a custom ring inquiry before the shop closes and How to follow up on every open ring consult without pestering anyone.
If you want help writing limits for your own agents, start the intake or email carlos@prmode.ai. Tell me which job you would hand off first.
FAQ
Sources
- OWASP, LLM06:2025 Excessive Agency. Names excessive functionality, permissions and autonomy as root causes, and lists human approval of high-impact actions among its mitigations.
- NIST, AI Risk Management Framework. A voluntary framework for managing risks of AI products, services and systems.
Structured data
Show the JSON-LD for this post
{
"@context": "https://schema.org",
"@graph": [
{
"@type": "BlogPosting",
"@id": "https://prmode.ai/ai-agent-written-limits#post",
"url": "https://prmode.ai/ai-agent-written-limits",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://prmode.ai/ai-agent-written-limits"
},
"headline": "How to write limits for an AI agent in your business",
"description": "Before an AI agent touches your CRM or inbox, write down what it may read and what it may send. A plain guide to approval first limits for small teams.",
"image": "https://prmode.ai/assets/og/ai-agent-written-limits.png",
"datePublished": "2026-10-16",
"dateModified": "2026-10-17",
"inLanguage": "en-US",
"isAccessibleForFree": true,
"about": [
{
"@type": "Thing",
"name": "Written limits for AI agents"
},
{
"@type": "Thing",
"name": "Human approval for AI agents"
}
],
"speakable": {
"@type": "SpeakableSpecification",
"cssSelector": [
"#post-title",
".key-takeaways"
]
},
"author": {
"@id": "https://prmode.ai/about#carlos"
},
"publisher": {
"@id": "https://prmode.ai/#org"
}
},
{
"@type": "Organization",
"@id": "https://prmode.ai/#org",
"name": "LUR",
"url": "https://prmode.ai/",
"logo": {
"@type": "ImageObject",
"@id": "https://prmode.ai/#logo",
"url": "https://prmode.ai/assets/icon-512.png",
"contentUrl": "https://prmode.ai/assets/icon-512.png",
"width": 512,
"height": 512
},
"email": "[email protected]",
"description": "LUR sets up AI inside the accounts realtors, sales teams and service companies already own, trains the team, and brings something new every month. Drafts only. A person approves what goes out.",
"founder": {
"@id": "https://prmode.ai/about#carlos"
}
},
{
"@type": "FAQPage",
"@id": "https://prmode.ai/ai-agent-written-limits#faq",
"isPartOf": {
"@id": "https://prmode.ai/ai-agent-written-limits#post"
},
"mainEntity": [
{
"@type": "Question",
"name": "Can an AI agent send messages without my approval?",
"acceptedAnswer": {
"@type": "Answer",
"text": "It can if someone sets it up that way. In LUR setups, anything a client or customer will see waits for a person on your team to approve it, and the written limit says so."
}
},
{
"@type": "Question",
"name": "Who writes the limits?",
"acceptedAnswer": {
"@type": "Answer",
"text": "We draft them with you during setup. You read them and change them before the agent goes live. They are written in plain language so you can keep them and edit them later."
}
},
{
"@type": "Question",
"name": "What happens if an agent does something outside its limit?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Tell us at the monthly check-in or by email. We look at whether the rule was missing from the sheet or the setup needs a change, then update one or the other with you."
}
},
{
"@type": "Question",
"name": "Do limits slow the agent down?",
"acceptedAnswer": {
"@type": "Answer",
"text": "The agent still does its part as soon as the work arrives. What waits is the send, and that waits for you."
}
},
{
"@type": "Question",
"name": "Do I need to be technical to write a limit?",
"acceptedAnswer": {
"@type": "Answer",
"text": "No. A limit is plain language. If you can explain the job to a new hire, you can write one."
}
}
]
},
{
"@type": "Person",
"@id": "https://prmode.ai/about#carlos",
"name": "Carlos Argueta",
"jobTitle": "Builder and owner, LUR",
"email": "[email protected]",
"url": "https://prmode.ai/about",
"sameAs": [
"https://www.linkedin.com/in/carlos-javier-argueta-12b9bb67"
],
"knowsLanguage": [
"English",
"Spanish",
"Dutch"
],
"homeLocation": {
"@type": "Place",
"address": {
"@type": "PostalAddress",
"addressRegion": "UT",
"addressCountry": "US"
}
},
"worksFor": {
"@id": "https://prmode.ai/#org"
}
},
{
"@type": "BreadcrumbList",
"itemListElement": [
{
"@type": "ListItem",
"position": 1,
"name": "LUR",
"item": "https://prmode.ai/"
},
{
"@type": "ListItem",
"position": 2,
"name": "Blog",
"item": "https://prmode.ai/blog"
},
{
"@type": "ListItem",
"position": 3,
"name": "How to write limits for an AI agent in your business",
"item": "https://prmode.ai/ai-agent-written-limits"
}
]
}
]
}