Setting clear limits for AI agents

One bad screen, or a gap in how agents are built?

Use is already wide. More than half of UK adults (54%) use AI tools, according to Ofcom. Adobe measured a 693% rise in visits to US retail sites from generative AI tools over the 2025 holidays. And agents are moving from answering to acting: they book, buy and reply, for a person, with a business on the other end.

Five interviews could not tell me whether this was one bad screen. So I went to organisations that had already measured it at scale.

Fourteen sources, chosen for how their data was collected

Each source collected its own data, said how and was published in the last two years. I set surveys, which record what people say, against traffic, audit and fraud data, which record what happens.

• People hand over tasks in steps. Accenture asked 25,590 people in 16 countries. Three in four would let an agent handle routine tasks, one in three would let it choose a purchase if they approved before paying, and fewer than one in ten would let it buy alone.
• People will not watch closely. Only 46% are willing to trust AI, in the University of Melbourne and KPMG study of more than 48,000 people. Yet 66% of people using AI at work rely on its output without checking it.
• Limits exist, but only for money. Visa and Mastercard both launched agent payments in April 2025, with limits the person sets. The September incident involved no payment at all: an address, a message and an offer.
• The other side cannot tell what was allowed. Imperva found 51% of web traffic is automated, so many sites treat automation as a threat. When an agent’s action goes wrong, there is nothing to show what the person agreed to.

The industry defines the agent and leaves out what the person allowed

No single source says this. Read together, they show the industry agreeing who an agent is and how much it may spend. What the person agreed to beyond money has no shape. It lives in one tap.

Four ways to hand over a task

• One Allow button is quick, and covers actions the person never meant.
• Asking before every action sounds safe. Given how few people check AI output, I expect it would turn into tapping yes without reading.
• Spending limits do nothing for an address, a message or a promise.
• A scoped permission costs one step before the agent starts. It was the only option that matched how people say they hand over tasks.

Four answers, set once, checked before every action

• The card is set where the task starts, in the words of the task. Anything that cannot be undone starts under Ask me first, so the safe answer is the default.
• The agent checks every action against it. Anything under Ask me first pauses the task and asks.
• The other side sees what is covered: what the agent can agree alone, what needs the person and when it ends. The Never list stays private, because it says more about the person than they chose to share.
• One record for both sides, so if something goes wrong, the person and the business look at the same thing.
• Every consequence is shown before it is approved, following Microsoft’s guidelines for human and AI interaction.

Try the prototypeTry three tasks, move the answers around and see what changes.

The ask has to work from a lock screen

People hand over tasks because they are busy, so the agent needs them at a moment they are doing something else. The ask is a notification that can be answered without opening anything, one question at a time. Until the person answers, the agent waits and tells the other side it is checking. Every ask costs attention, which is why the prototype counts buzzes.

A small kit that takes each app’s look and keeps the answers the same

The card will live inside other companies’ apps: a marketplace, a restaurant’s booking page, a grocer’s checkout. So the kit has two kinds of token.

• Host tokens follow the app: surface, text and button colours, corners and typeface.
• Answer tokens are locked. Each answer has a shape, a colour and a name that look the same everywhere, so people learn them once.
• One rule for hosts: any surface works as long as every answer keeps at least 4.5 to 1 contrast against it. All four pass in light and dark mode.

How I would know it works

What changed as I built it

• The ask was a panel on a web page, like a form. I redrew it as a phone notification, because that is where the person is when the agent needs them.
• The answers were words only. Once the card had to sit inside other apps, each answer needed a mark and a colour that stay the same everywhere.

Desk research found the gap, and cannot prove the fix

None of this shows that a person would fill in four answers, or that a real agent would keep to them. Next, I would test the card with five people, then give an agent written limits and see where it breaks them.

Before recruiting, I tested whether AI personas could stand in for those five people. They agreed with each other far more than people do, and none of them tapped Allow always.

If you see a flaw in how I read the sources, tell me.

Figures were checked against each organisation’s own publication in October 2026. The Gartner and WebAIM figures were checked against two independent reports of the original, because the original pages would not load for me.