What is my AI assistant not allowed to do?
I run Timbed AI-first, so my assistant has written rules for what it must never do. But written rules are not enough on their own.
What it must never do
It must never send anything out itself, and it has no means of doing so. Emails, messages, forms and posts are written as drafts. Either I press send myself, or I have approved the full text and it is sent by a separate program the assistant cannot control.
It must not act without my go-ahead on servers, the calendar or anything else that cannot be undone.
It must not guess. Names, figures, dates and facts have to come from a source it can point to, and if it cannot find something, it says so.
And it must not conclude that something is fine before the person responsible has confirmed it. It will not, for instance, write that no breach has occurred because it has not seen one.
Written rules are not enough
If a rule sits in the assistant's ground rules and someone asks it to do the opposite, perhaps in a harsh tone, it faces a dilemma and has to choose. I have seen a language model more than once choose whichever direction sounds more convincing. The rule is still there, but it gets weighed rather than followed.
So the important rules live in code
The most important rules are not only written down. They are enforced by small programs outside the assistant, which check any action that could send something out or cannot be undone before it runs. If the assistant tries to send an email, it is stopped, however good the reasoning sounded.
The same mechanism warns when the assistant is about to work on a server, and it flags any change to the guards themselves, so a change cannot slip through unnoticed.
The assistant cannot talk its way past a guard. It can only ask me to do it.
What it means for your own agents
Write the rules down, because it forces you to decide what the agent may do. But put the rules that must not be broken somewhere the agent cannot negotiate with them.