Bounded actions

Purpose

Constrain an AI-assisted action by permission, preview, approval, monitoring, rollback, and escalation. The workflow is acceptable only while its evidence, permission, review, and stop boundaries remain true.

Prerequisites

• A tool contract enforced outside the model: allowed tools, records, fields, and values.
• Rollback for every allowed write, tested before the pilot.
• A named approver and an execution log.

Worked example

Allowlist. Tool crm.update_contact only. Records: contacts in review queue Q-118, at most 50 per run. Fields: lifecycle_stage (lead, opportunity, customer) and next_follow_up_date. No deletes, emails, or new fields.

Previewed action.

{
  "actionId": "q118-C5521-lifecycle-2026-11-06",
  "record": "C-5521",
  "field": "lifecycle_stage",
  "from": "lead",
  "to": "opportunity",
  "evidence": "Meeting booked 2026-11-04 (activity A-889)"
}

Procedure

1. The model proposes actions; deterministic code validates each against the allowlist before any preview.
2. Show the approver the exact preview with the current value, new value, and evidence.
3. Execute only the approved payload, once, using its action ID as an idempotency key.
4. Before writing, confirm the current value still equals the previewed one; otherwise stop.
5. Log the result and keep the prior value so rollback can restore it.

Deterministic and review checks

• Record in queue, field allow-listed, and value in the permitted set.
• A retried action ID is a no-op rather than a second write.
• The executed payload matches the approved preview exactly.
• Rollback restores the prior value in a staging test.

A case that must fail

A proposal to change the owner field is not allow-listed. It is rejected before preview and logged; repeated rejections stop the run.

Human boundary

The approver authorizes each batch from the preview. The system cannot grant itself tools, fields, records, or a larger batch.

Stop and escalation

• Never let the system expand its own permissions.
• Stop on unexpected targets, duplicate actions, or missing rollback.