Essay

What should an AI assistant be allowed to do without asking you?

This month Amazon and Salesforce opened their software to AI assistants: nobody has to log in anymore. That makes one question more important than which package you use: what may such an assistant decide on its own?

September 28, 2026 · Levy van Bremen · Lees in het Nederlands

On September 15, Salesforce, the system companies use to keep track of their customers and sales, announced AIforce. The core idea is in the announcement itself: people no longer have to come to Salesforce to get work done, Salesforce comes to them, in Claude, in Slack or wherever they work. Eight days later Amazon followed. Anyone selling on Amazon can now manage inventory, prices and product pages from an AI assistant such as Claude, for now as a trial version in the United States. “Our vision was that they would never have to log into Seller Central,” Mary Beth Westmoreland, who is responsible for the seller experience at Amazon, told the tech site GeekWire.

By an AI assistant I mean more than a chat window that answers questions. I mean a program that can read and act inside your systems through a fixed connection: change a price, create an order, send a customer a message. The screen your staff click through all day becomes secondary. Salesforce co-founder Parker Harris, who built the current Salesforce screens himself, was already asking in March why you would ever log in again.

My argument: when nobody logs in anymore, the control that logging in quietly provided disappears too. You have to write that control down yourself, action by action, before you let an assistant act. An approval button is not enough for that.

The screen was also a brake

Software with screens has a property few business owners think about: there is always a person in between. Whoever adjusts a price also sees that the product just got a bad review. Whoever books an invoice sees that the amount is higher than last month. Many of a company's rules are written down nowhere. They live in the eye of whoever is clicking.

Salesforce knows this. According to the announcement, every request runs on existing permissions and business rules, an agent sees only what the person asking can see, and every action routes back through Salesforce. Vernon Keenan, publisher of the trade site SalesforceDevops.net, counted four promises about control in that announcement against one about intelligence. In his view the value lies in what the assistant reads: twenty years of validation rules, approval routing and other logic that administrators put there by hand. Scarcity, he writes, is shifting from intelligence to control.

For a large company with administrators who have maintained those rules for years, that holds. Most business owners don't have that. Their rules live in people's heads. Sales support may give up to five percent discount on their own. We call that one big client before a payment reminder goes out. No system knows agreements like these, and so neither does any assistant working through that system.

This is not only happening in America. For Exact Online, the Dutch accounting and administration package, there are already connections that let an assistant such as Claude or ChatGPT create sales orders, match purchase invoices to orders and send payment reminders. One of those providers lets you set, per action, whether the assistant may write and up to what amount.

Why an approval button is not enough

Amazon has thought about control. According to its own announcement, sellers choose per task whether the assistant only makes recommendations or acts itself. If it acts, the seller approves each action first, and everything is logged. At the same time Amazon is introducing tasks that run continuously, even when the seller is not logged in, such as watching inventory and tracking competitor prices. The seller describes in plain language what they want and sets limits.

Those limits are the most important part, and they get the least attention. Look at the numbers Anthropic, the maker of Claude, gives in the same announcement. Sellers make dozens of decisions a day on pricing, inventory and ads, and they accept the assistant's recommendations more than 90 percent of the time. That speaks well of the recommendations. It also says something about approving. If you get a proposal dozens of times a day and say yes nine times out of ten, after a few weeks you are no longer judging. You are clicking.

I see the other side in my own work. I build on my own, and in my own system AI agents, programs that carry out tasks independently, do much of the recurring work. On one day last week one of those agents asked three times whether it could write to a log file. On another day five work sessions had been waiting hours for my answer. If everything has to go through me, I become the funnel where the work gets stuck.

So where the rule is clear, I let the system act on its own. Gemeenteregels, my service that answers questions about local rules with the article from the official text, has a weekly check that verifies whether what the search function uses still matches that official text, and repairs any differences itself. I don't need to click for that, because what counts as correct is settled in advance.

The work, then, happens before the button. Sort every action an assistant can take in your systems into three groups:

The strongest objection: wait a little longer

The best argument against all this is that the technology is young and the mistakes are big. On September 25, TechRadar described how an AI assistant for programmers, asked to refresh a copy of a project, wrote its own cleanup script. That script deleted more than 48,000 files in 103 seconds, including the full version history. Recovery was no longer possible. Why would you let a program like that near your administration?

I take that argument seriously, but it proves something other than it seems to. It went wrong because the assistant worked on live files, without a backup, and was allowed to decide for itself what to delete. That is exactly the question you have to answer in advance.

Waiting also protects you less than you think. According to Amazon, 90 percent of its sellers already use third-party AI tools to run their business. Chances are it is no different in your company, and your staff are already pasting customer data and figures into a chat window, without permissions, without a log and without limits. A proper connection with written rules is safer than that.

There is a second objection: this mainly serves the big vendors. There is something to that. Kin Lane, who writes about how software talks to other software, pointed out that Amazon opened the door to sellers' assistants but kept it shut to buyers' assistants. In his view Amazon has nothing against agents, as long as Amazon decides which ones get in. The vendor chooses which doors open. That is exactly why the list of what an assistant may do belongs with you, and not only in a package's settings menu. Then you take it with you when you switch.

The choice to make now

That more and more software packages will let assistants in is no longer in question. Salesforce and Amazon already do, and for Exact Online the connections are ready. What is still open is who writes the rules.

This month, pick one process with many actions in it, for example collecting invoices or keeping prices up to date. Write down every action and put one of the three groups next to it. For “allowed on its own”, set a limit in euros or percentages. Agree who approves proposals and within how much time, so nothing sits waiting for hours. Then check whether your package can enforce those limits and records every action. If it cannot, do not let an assistant act in that process yet.

For one process that is half a day's work, and no vendor can do it for you. The choice in front of you now is whether you spend that half day yourself, or whether your vendor's default settings will soon decide what happens in your business without anyone seeing it.

Sources

Is there work in your business that comes back every week? That is what I build software for.

Book a call →