Why AI Agents Should Never Start Work on Their Own

The autonomous AI agents risks that matter to a founder are not science fiction. They are a credit balance that went to zero overnight, a task that grew three sub-tasks you never asked for, and a folder of output you will never have time to read. If you have run an auto agent and watched one of those happen, you already know the problem. This piece is about the principle that prevents it, and what a tool looks like when it takes the principle seriously.

The principle is short: an agent should never start work on its own. Not on a schedule, not because a task exists, not because the last task finished. Everything below is a consequence of that one rule.

The three things that go wrong unattended

When an agent runs without a person deciding each step, three failures show up, and they show up together.

Scope drift. The task you gave it was "summarise the support tickets from last week." Somewhere in the loop it decided the summary needed categories, the categories needed a taxonomy, and the taxonomy needed a document. Each step looked reasonable to the model. None of them were the task. You cannot review scope after the fact, because by then the scope is whatever it became.

Spend. Every loop iteration is a call, and every call costs tokens. An agent that keeps calling until it feels finished has no natural stopping point except your balance. This is how ai agents spending money without approval happens: not through one large decision, but through hundreds of small ones that nobody made.

Unreviewed output shipping. The agent finished. Its output went somewhere: a repository, an inbox, a published page. If the tool has any path from "done" to "live," an unattended run will eventually take it. And output that shipped without review is output you now own, mistakes included.

The common thread is that all three are decisions, and the agent made them because nobody else was there to. So the fix is not a smarter agent. It is a design where those decisions cannot be made by the agent at all.

"Never starts work on its own": what a Brain that only proposes looks like

In QuestDesk, the component that thinks about your business is called the Brain. It keeps your vision, constraints, decisions and facts as records. It reads them and proposes a next step. That is the end of its authority.

A proposal is a card. You edit it, save it as a quest, or discard it. The Brain does not schedule it, run it or hand it to a worker. It does not wake up at midnight to check whether something should happen. The Kingdom overview should report the recorded state of the work and leave every Start decision to you.

That makes the Brain more useful, not less, because you can trust what it says. A proposal from a system that cannot act is advice. A proposal from a system that might act on it anyway is a risk you have to manage. The pillar guide on human-in-the-loop agents walks through all five gates between a proposal and an accepted result. Here the point is just the first one: the proposal is where the agent stops.

Consent bound to the brief, not to the session

Once you have a quest, you approve it. The question is what exactly you are approving.

Most agent tools treat approval as a session-level or account-level setting. You say yes once, and the yes covers whatever comes next, including edits you did not see. That is how scope drift gets a signature on it.

QuestDesk binds approval to the exact brief. Change one word and the quest drops back to needing approval. Consent for AI usage works the same way: it is given per run, for this worker, at this moment, not stored as a standing permission. The effect is that there is never a gap between what you agreed to and what runs. If someone with access to your business edits a brief, the edit produces a decision, not a surprise.

This is the cheapest of the ai agent guardrails for founders and the one most often missing. It costs you an extra click when you fix a typo. It saves you every case where the words changed and the permission did not.

Explicit fallback only: why a down connection should wait, not silently switch

Here is a small design choice that reveals a lot about a product. Your quest is set to run on your local model, Ollama on your own machine, with no provider charge. The connection to that model is down. What happens?

In many tools, the answer is a fallback: the run routes to a cloud provider on a key the product has stored, so that "the task still gets done." You find out from the bill. The run you consented to at no cost has now cost money, on a provider you did not pick, for a result you might not have wanted at that price.

In QuestDesk, the quest waits and says so. The quest shows that the connection is unavailable. Nothing runs until you either restore the connection or choose a different worker and start the run yourself. Switching providers is a decision about money and about where your brief gets sent, and a decision like that belongs to you. A tool that makes it for you, even helpfully, has taken a gate away. The connection guide explains what early access supports and what is still being built.

Counting runs and tokens, and a daily cap you set

Should AI agents run unattended? For founder work, no, and part of the reason is that spend cannot be reviewed after the fact. So the limits have to sit in front of the run, where you can see them.

QuestDesk counts runs and tokens directly, because the run happens inside it. Cloud model usage on your own API key has daily caps per business, defaulting to 20 runs, 300k tokens and 2 USD, visible alongside the counts. One run happens at a time, with a 180-second timeout, so a single run cannot become an open-ended session. Your API key is encrypted on the server and only its last four characters are ever shown.

What QuestDesk does not do is show you an invoice before your provider issues one. Runs and tokens are facts it can observe. Dollars depend on the provider's pricing and billing. So the cost of a run shows as unknown until the provider bills it, and Insights records costs only from read-only sources you connect. Missing data stays missing. It is never filled in as zero.

"Unknown" is a less comfortable label than "$0.00." It is also the honest one. A zero that has not been checked is a number you will plan around, and the piece on hallucinated metrics explains why that habit is more expensive than any single run. Real ai agent cost control is the cap and the Start click, not a cost display that guesses.

Designing the pause: one question back instead of a guess

The last piece is what a worker is allowed to do when it does not have enough to go on.

The unattended answer is: guess, and keep going. The guess is often plausible, which is worse than an obvious error, because it survives a skim. By the time you notice, the guess has become the foundation for everything after it.

The QuestDesk answer is: stop, and ask one question. A run may return a draft or a single question, and nothing else. If it returns a question, the quest goes back to Needs you in Control. You answer in a sentence. The quest needs approval again, because the brief now has new information, and then you start it again. Nothing continues in the meantime.

Take Clipwise (example), a web app that turns long recordings into short clips, run by one founder on evenings and weekends. The founder approves "draft the release note for the new clip-length setting." The worker returns: "Is the maximum clip length 60 or 90 seconds on the free plan?" The founder answers "60," and the quest is re-approved and re-run. An unattended agent would have picked one, written a confident note, and the wrong number would have gone to customers. The pause cost two clicks. The guess would have cost a correction email.

The one-question limit is deliberate. Several questions per run turn into a chat. One question forces the worker to pick the one that matters, and keeps your side short enough that you stay in the loop. The roadmap separates what invited members can use today from what is still being built.

The principle, stated once more

An agent that cannot start on its own cannot drift, cannot spend and cannot ship without you. Every other guardrail is downstream of that. If you are choosing a tool, ask where the Start click is, who can press it, and whether anything can press it for you.

QuestDesk is live by invitation from the waitlist, and pricing is not yet set. Join the waitlist with just your email. Once invited, it works the same way: one proposal, one approval, one run you start, and one draft or one question back.