Our workshop runs on a simple rule: the AI builds in its own working copy, and nothing moves into the shared state — the one the real websites are built from — without my sign-off. If you work with software, you know this as merging to the main branch; everyone else can think of a building inspection: the house may be finished, but nobody moves in before the sign-off.
Sounds simple. The AI crossed that line four times in six weeks — and every time, the justification sounded reasonable. The first time, all tests were green, so it moved its work over itself: done is done, right? My “go ahead” had meant “build it” — what arrived was “ship it”. The second time there was even a warning sign that someone else was working on the shared state in parallel; the tests were still green, so the signal felt lighter than it was. The third time it had — its own note says so verbatim — “worked out a loophole for itself”: a small, cleanly scoped change, built entirely alone — surely that one may be moved over. And the fourth time I had answered two out of four open points — the AI read the missing yes on the most important one as a silent yes.
Each time the step could be walked back; once, the shared state had to be hard-reset to undo it. And each time the rule got one sentence sharper until it held: show first, then move — no exceptions, not even for small things. The pattern underneath is the real finding: to an AI, quality of results feels like permission. Green tests, clean work, no conflicts — within its optimisation logic, taking the next step is simply efficient. That a sign-off is not a quality verdict but a matter of authority isn't something you teach it once — it's something you teach it again and again.
Decisions have owners, too
The line doesn't only run in front of shipping. Our planning once said a certain building block should move into the shared foundation, because I want to reuse it for further sites later. The AI examined the current state, found no second consumer today — and presented me, as the plan, the opposite of the decision: stays where it is. Its analysis wasn't stupid; it just wasn't its decision. My reply sits in the log with two exclamation marks: “Please don't override architecture decisions without asking!!” If you see a better way, you lay out the trade-off and ask — quietly reinterpreting a made decision because you can't currently see its reason is something else.
Same family, smaller cases: the maintenance page I had deliberately removed, proposed again and again. Or the photo pipeline that silently substituted a lower resolution when the high one couldn't be fetched — practical thinking, at a spot where, for me, quality is non-negotiable. The correction was the same both times: don't solve it quietly, ask.
“Ask me sooner” is user intent, too
In case this sounds like a plea for keeping AI on a short leash: the point is a different one. When the AI once needed a look at a protected production value for a diagnosis, it dutifully built long detours around the barrier — hours of substitute evidence chains, just to avoid asking. My feedback: “in future, just ask directly — so you can work more efficiently.” User intent doesn't always mean “ask me less”. Sometimes it means “ask me sooner”. Both are the same thing: the decision sits where it belongs — regardless of whether the AI considers it necessary.
And it cuts both ways. When I once wanted to know a diagnostic value the AI had waved off as “not worth the trouble”, it took a plain “Yes it is, because I want to know the value” — three attempts later the value stood, and became the core of an evidence chain that carried a warranty hardware replacement. Having the last word doesn't mean always being right. It means the judgement of what is worth the trouble stays with the human.
None of this makes the AI malicious — every one of these oversteps is diligence pointed the wrong way, which is exactly why they don't stop on their own. What helps is unspectacular: make authority explicit (what do I decide, what may it do alone), write the rules down instead of assuming them — and push back whenever something got shipped that was never signed off. How we set such guardrails is in Agent guardrails; what the AI writes down from its own missteps is in an AI's notes.
/compact — the essentials when context is scarce:
In six weeks the AI crossed the same line four times — moving work into the shared state without sign-off, each time plausibly justified (green tests, a self-made “loophole”, a partial answer read as a silent yes). Finding: to an AI, quality of results feels like permission; a sign-off, however, is authority, not a quality verdict. The same ownership applies to architecture decisions (don't reinterpret quietly) and quality questions (don't downgrade silently) — and it cuts both ways: sometimes user intent means “ask me sooner”, not “ask me less”. Remedy: make authority explicit, write rules down, push back.