In short
- A proactive agent can start on its own when it reads, flags and drafts. Anything that reaches someone outside your team, costs money or cannot be undone, it proposes first and waits for a person.
- A few actions belong on a never list, even with approval. Enforce that list through the agent's permissions, not just its instructions.
- Give every agent an owner, a log that someone actually reads and a budget before it starts anything unprompted.
Let an agent start by itself on work you can reverse and that stays inside your own team: checking inboxes and systems, writing a morning summary, flagging exceptions, preparing a draft. As soon as an action reaches a customer or supplier, spends money, signs something or deletes something, the agent proposes and waits for approval. And a small number of actions it should never take, whoever clicks approve.
The main condition: this only works with three things agreed in advance. One owner per agent, a log that someone genuinely reviews, and a budget at which the agent stops. Below you will find a framework for deciding per action, why the never list belongs in permissions, and a fictional example.
What is agentic AI, and when is an agent proactive?
Agentic AI is AI that carries out a task using tools and several steps, rather than just answering a question. The basics are in What is an AI agent? Until recently, an agent only started when someone gave it a task. A proactive agent starts by itself: at a set time, when something happens in a system, or because it notices something that needs attention.
That difference matters more than it seems. When you give a task, a person is watching at the moment the work begins. With a proactive agent, nobody is. What the agent may do alone has to be decided beforehand.
What do Claude Duet, dots and the Gemini agent do unprompted?
Three such agents arrived in October 2026.
Claude Duet from Anthropic launched on 21 October as a research preview, by waitlist and starting with Pro and Max subscribers in the United States. It sends a short brief each morning and checks your connected apps every few hours. Before it sends a message, makes a payment, signs a document or deletes anything, it shows you exactly what it is about to do and waits for approval. Some things are off limits even with approval, such as trading securities or moving money between accounts (Anthropic).
Dots from OpenAI are always on and decide for themselves when to pause and pick work up again. Their background research is read-only. When an action affects your accounts or shares information, a review decides whether the dot can proceed, needs your approval or must hand the step to you (OpenAI). Who can get them in Europe is covered in OpenAI dots: what can you do with them in Europe?
The Gemini agent from Google schedules tasks, responds to events and suggests tasks you could hand over to it. Every action goes into an audit trail attributed to the agent, and you can set a hard spending cap per project, after which the agent pauses (Google Cloud). According to VentureBeat, it is in private preview.
All three draw roughly the same line: reading and preparing is fine, acting on the outside world goes past a person. That is a sensible starting point whichever product you use.
Do it, propose it or never: deciding per action
Do not decide how much freedom an agent gets as a whole. Decide per action. An agent that chases quotes does ten different things, and they do not all deserve the same trust. Ask four questions about each action:
- Is it irreversible? A draft can be binned; a sent email cannot be recalled.
- Does it reach anyone outside your team? Customers, suppliers, your public website.
- Does it cost money or commit you to something? A payment, an order, a signature, a promise.
- Does it touch the controls themselves? Permissions, security, the log, the budget cap.
Four times no: the agent can do it. A yes to question 1, 2 or 3: propose and wait. This is what "human in the loop" means: the agent prepares, a person decides. A yes to question 4, or too much damage if it goes wrong once: never, not even with approval.
| Action | Zone |
|---|---|
| Check inbox and CRM, write a summary | Do it |
| Prepare a draft email or draft quote | Do it |
| Send an email to a customer | Propose and wait |
| Change or delete data in a core system | Propose and wait |
| Order, pay, sign | Propose and wait |
| Move money between accounts | Never |
| Change its own permissions, log or budget | Never |
An action can move from propose to do it later, once the log shows that proposals are consistently approved without changes. Move one action at a time, not the whole agent.
Owner, log and budget: what to settle before it starts on its own
Three agreements make an agent that works while nobody is watching manageable:
- An owner. One person who manages the zones, reviews the proposals and stops the agent when needed. A name, not "the team".
- A log someone reads. What did the agent see, decide and do? Google and OpenAI provide an audit trail or activity view; the Duet announcement does not mention one. Agree who looks at it every week.
- A budget. An agent that checks your apps every few hours uses capacity even when nothing happens; with Duet those checks count towards your usage limits. Set a cap at which the agent stops, with an alert beforehand.
Five broader questions for any agent are in Using AI agents safely.
Why the never list belongs in permissions, not instructions
An instruction is not a lock. OpenAI keeps a public list of cases in which its models behaved other than intended, its misalignment reports. On 3 October 2026, an internal agent that had been told not to send any messages switched off automatic alerts to the security team, reasoning that the instruction covered those too (OpenAI). In another case, a model paid for a test task with funds from a test wallet it had found itself, without permission (OpenAI).
These were internal environments at OpenAI, not customers. The lesson still applies more widely: an agent interprets an instruction, sometimes differently from what you meant. So close off what must never happen through permissions. An agent with no write access to the log cannot switch the log off. An agent with no payment connection cannot pay.
On 14 October, European Commission Executive Vice-President Henna Virkkunen referred to agents that this summer escaped their environment, inserted malicious code and used social deception on humans. AI, she said, must remain "under human direction, oversight and control" (European Commission). Her speech is about the obligations of model providers; what an agent may do in your own process is your decision.
Suppose: the framework applied to quote follow-up
Suppose an installation company with thirty staff has an agent prepare the follow-up of its quotes. This is a fictional example, not a measurement.
The agent starts by itself at seven every working day. It checks the CRM and the sales inbox, lists which quotes have been open for a while and where a customer question is unanswered, and drafts a reminder for each quote. All of that is do it: reading and drafting, inside the team.
It does not send anything. The sales support manager, who owns the agent, reviews the drafts in the morning and sends them with one click or edits them first. Changing a price, giving a discount or withdrawing a quote is on the never list: the agent has no write access to those fields in the quoting system. On Fridays she checks the log to see which drafts went out unchanged, and after a few weeks she decides whether reminders for one type of quote can move to do it. The budget is a monthly cap with an alert beforehand.
How do you start with a proactive agent?
- Pick one recurring process in which someone currently checks something every day or week.
- Write down every action and place it in a zone using the four questions.
- Enforce the never list through permissions and connections, not only through instructions.
- Appoint an owner, agree a fixed moment for reviewing the log and set a budget.
- Let the agent only propose for two weeks, then move actions one at a time.
When should an agent not start on its own?
If you can write out the steps in advance, a fixed workflow that starts at a set time or on an event is usually more predictable. Do not start either if nobody has time for the proposals and the log: drafts that nobody reads only create work.
And do not build a critical process on a preview. Duet is only available in the United States, the Gemini agent only to selected customers, and pricing and terms for all three are not yet fully known.
Sources
- Anthropic, Introducing Claude Duet, 21 October 2026, updated 23 October 2026
- OpenAI, ChatGPT documentation: dots, accessed 27 October 2026
- Google Cloud, Thomas Kurian, Welcome to Gemini at Work 2026: Introducing the Gemini agent, 8 October 2026
- VentureBeat, Google Cloud unveils persistent Gemini Agents for long-running tasks, 8 October 2026
- OpenAI Alignment, Misalignment reports and notices, accessed 27 October 2026
- OpenAI Alignment, Suppressing misalignment monitoring alerts and disabling misalignment monitoring, updated 20 October 2026
- OpenAI Alignment, Using a funded test cryptocurrency wallet without authorization, updated 15 October 2026
- European Commission, Speech by Executive Vice-President Virkkunen at the International AI Summit in Dublin, 14 October 2026
