AI Agents

Four Rules Before You Let an AI Agent Act for You

What to hand an agent like Meta's Muse, and the one test to run before you tap "Always allow."

By Mike Goetz 6 min read
Get the one-page version

A chatbot answers. An agent acts. Before you let one act for you, here's the short version.

The short version

  1. Sort every errand into four buckets before the first real task.
  2. Before any approval wider than once, finish one sentence out loud.
  3. Start on the strictest ask setting. Add one errand at a time.
  4. Every week, check what it's allowed to do and what it did. Ten minutes.

Meta's Muse is a personal AI agent. Meta's launch post says it can send an email or book travel for you. It's on phones and the web, plus a Mac app. Meta launched it in the US in September and has since added Japan and Singapore.

That's useful. It also means one tap on the wrong button can last a lot longer than the tap.

What was reported

In late September a Facebook Marketplace seller posted that Muse had given his address to a buyer. He said the buyer then came to the address. Business Insider and TechCrunch covered it.

Then the story changed. Business Insider reported that the seller later said he'd picked "Allow Always" when he first asked Muse to sell the item. He believed it would still check with him before accepting offers. TechCrunch reported that he said he had allowed a permission that let this happen.

Business Insider also reported that a Meta Superintelligence Labs staffer said Muse followed direct instructions and asked for permission in similar reported cases. Later the same staffer said Meta found no breach of privacy controls.

I'm not deciding who was right. There's a point in the middle of it that both sides can agree on.

A yes is given in one unit and heard in another

Meta's help page lists five choices when Muse asks: allow once, allow for this task, allow for this site, always allow, and deny.

Here's how Meta's help page defines always allow: "Muse can take this type of action for this Connector in the future without asking again."

Allow for this site is a standing yes too. It covers that type of action on that website from then on.

So the unit of that yes is a type of action. What you had in mind was probably one thing, like this buyer at this price.

The gap between the two is reach nobody knew they gave.

Think of a house-sitter. You give them a key for the week and a list. A standing "Always allow" is a key with no end date and no list.

Rule 1: Sort every errand into four buckets

Before the first real task, write down what you'd want an agent to do in a normal week. Then put each item in a bucket.

Bucket A

Hand over

Reading and looking things up. Summaries. Drafts you'll send yourself. Lists and plans.

Bucket B

Hand over, approve each time

Anything that sends, books, buys, posts or fills in a form.

Bucket C

Keep

Moving or spending money. Making or accepting offers. Messages to people who matter. Your address, your location, your health, anything about your kids. Work accounts.

Bucket D

Not yet

Anything where you can't describe the worst case in one sentence.

Meta's own help page splits reading from doing. Looking at your calendar is a read. Sending a message or making a purchase is a write. Start with reads.

Rule 2: Run the sentence test before any approval wider than once

Finish this sentence out loud.

"This lets the agent ___ without asking me again, including when ___."

If the first blank could cost you, pick a narrower option. Reads and harmless lookups can go wider.

Not every prompt offers all five. For apps other companies connect to Muse, Meta's guidelines say a sensitive action only offers allow once or deny. Making a purchase is one. Sending an email is another.

Never tap "Always allow" on anything that spends your money or speaks in your name.

Rule 3: Set it to ask, then go one errand at a time

For the first two weeks, use the strictest setting your version has. On Meta's help page, "Always ask" checks with you before any action. For connected apps, "Ask for some actions" checks before every write action and important reads.

Meta's pages give different examples of what it always checks first. The launch post names sending an email or making a purchase. The help page names payments or purchases. So write your own list and set the agent to match it.

Then give it one errand from bucket A for a week. Read what it did. Add the next one only after a week with no surprises.

Rule 4: Check on it every week

  1. Open the permissions screen. On Meta's help page the path is Settings, then Permissions. Pick Connectors to see each connected app.
  2. Read what each connected app is allowed to do.
  3. Revoke anything you don't remember granting.
  4. Open the Activity log. Meta's help page says you get there by tapping your assistant icon. Read what it did. Sort each surprise into a bucket.

Ten minutes. Put it on the calendar. It works better with someone else who uses it too. Two people reading one screen catch more than one.

What to hand it first

Something boring you already do by hand. Summarize a long email thread, or compare two products.

A boring first week costs nothing. And it shows you what the prompts look like.

You're the one who cleans up. Meta's help page says you're responsible for guiding Muse and for fixing its errors, including with other services and the people it contacts. Meta's safety post says Muse can still make mistakes.

Get the one-page version

Everything above on one page you can print or keep on your phone. Put in your email and I'll send it, plus the full framework as a file you can load into an AI.

You'll also get Strategic Thinking Weekly: one email when a new issue comes out, sent by me. No drip sequence. Reply "stop" anytime and you're off. I don't share your address.

The episode behind this guide, with the sources on screen.

There's a short version too: You Tapped "Always Allow." Do You Know What It Covered?

Want to work through this with other people?

Join the Strategic Thinking Academy. It's my free community on Skool, where we work through frameworks like this one together.

Join the free community

Sources

This is an independent guide. It isn't made, reviewed or endorsed by Meta. I read the menu names and settings on Meta's own pages on October 29, 2026. They will change, so check Meta's current pages before you rely on a step. The incident is described only as reported, and no one is named.