Ying Hao Ma·Notes

Rules for letting software act

May 2026

AI amplifies the person using it. Skilled hands get wonderful things out of it. Careless hands get a mess, delivered faster and at scale. Nowhere is that sharper than the moment you let it act: send a message, file a document, move money.

My assistant can act. It sends mail, prepares payments, files documents. Here are the standing rules that make me comfortable with that, and none of them involve trusting the model.

MODEL PROPOSES AN ACTIONsuggests · never executesONE-TIME APPROVALCODE RETURNED?yesnoREROUTED TO REVIEWnever silently droppedDETERMINISTIC EXECUTORdry-run default · hard caps · allow-listAUDIT LOGNothing in the model’s context can skip the gate.

A model never sits in a send path. It can propose. The thing that executes is a deterministic script with mechanical gates.

Approval is a code, not a vibe. An action that matters generates a one-time code, and I approve by returning it. No code, no action. A persuasive conversation cannot talk its way past this, because the gate does not read conversations.

Dry-run is the default. Every acting script starts in a mode that prints what it would do. Going live is an explicit flag, with hard caps on volume and amounts.

Payments are allow-listed, default deny. A new payee does not happen because a message claimed urgency, and the bank’s own in-app approval stays in place as the final human gate.

Everything that acts writes an audit log, and anything odd is rerouted to me for review instead of being discarded. Surface, never silently drop. That is the house rule.

These rules cost me some convenience. The assistant sometimes asks when it could have guessed. That is the point. Amplifiers need brakes sized to the amplification, and this discipline is the difference between a clever demo and something you can leave running while you sleep.