Skip to content
The AI Agent Factory

Monday's decision

Approved by
Panaversity ·
15 min read

One email to answer

Nisha read Dana's email three times. "Who at your firm can release these files when you are away?"

For eleven Fridays the honest answer had been "I can." On the twelfth, the honest answer was "Nobody." She had to reply by the end of the day. She also had a fourth client waiting: a distributor in Texas that wanted the same weekly service, starting next month.

Whatever she told Dana had to be true every Friday from now on, with four clients, and on days when she was on a flight.

Sana's skill had fixed how the file was made. It had not fixed who could release it. That part was Nisha's.

What she now knew about her channel

She drew the channel on a sheet of paper.

Three people could hand the worker work. One mailbox could send. Her rule said the worker should wait for an approval. On Friday the worker had told an approval from a sentence that mentioned one. But that was the worker's judgment. In that channel, the mailbox answered to anyone who asked.1

She had given the worker its own name. She had not decided whose word it should take, or who could give that word when she was away.

Three ways to release the Friday file. Three cards side by side. Card 1, Write a better rule: the worker sends only after an approver names today's file. Enforced by words. One hour and no cost. It still trusts that nobody types the words without checking. Card 2, A release channel: the mailbox moves to a private channel with only Nisha and Sana. Enforced by a setting. Half a day, and an approver must be there every Friday. It still trusts that approvers read the file before they type. Card 3, A small approval system: the worker can only propose a send, and a named person approves one exact file. Enforced by a record. About 6,000 dollars, then 60 dollars a month. It still trusts that the approver reads what the page shows. A red-bordered box says the decision is hers alone. A callout says no option removes trust, and each one moves it to a smaller group.

Three ways to release the file

She wrote down three options (Exhibit 8). All costs are made up.

1. Write a better rule. Change the channel's instructions: "Send only after Nisha or Sana writes 'approved' and names today's file and its reconciled cash figure. Never send a file with an open item."

It would take an hour and cost nothing. But it was still a sentence. On Friday the worker had read her old sentence well. Nothing made it read the next one the same way. Hamza, or anyone in the channel, could still ask. In that channel everyone had the same access,2 so only the worker's reading stood between a request and a send. By default, any member could also edit the rule itself. And a rule in the channel's instructions was guidance, however well it was written.

2. A release channel. Take the mailbox away from #lakeshore-work. Apply it to a new private channel, #lakeshore-release, with only Nisha and Sana in it.3 Everyone could still prepare the file. Only two people could cause a send from the firm's mailbox, because only two people were in the one place where that mailbox existed.

It would take half a day. It was a setting, not a sentence. If Hamza asked the worker to send from the work channel, there would be no mailbox there to send with. He could not ask the worker to post into the release channel either, because Claude does not post into a private channel from somewhere else.4

The release channel controlled one thing: the shared mailbox. It did not control a person's own email. If Hamza sent the file from his own account, or let the worker use his own email connector, the email would carry Hamza's name, not the firm's.5 Dana would see that it had not come from reports@.

The channel before and after a release channel. On the left, before: one private channel, lakeshore-work, with Nisha, Sana and Hamza, holding the bank key, the drive folder and the mailbox. All three people can cause a send. On the right, after: two channels. Lakeshore-work keeps Nisha, Sana and Hamza, with the bank key and the drive folder and no mailbox. A new private channel, lakeshore-release, has only Nisha and Sana, with the drive folder and the mailbox. Only Nisha or Sana can cause a send. A band says Hamza can still prepare the file, but he has no mailbox to ask for. A callout says the rule did not change who could send, and the setting did.

But it had a price. One of two people had to be awake and reachable by 6 p.m. every Friday. Sana did not work Fridays. And it still trusted whatever an approver typed. If Sana wrote "approved, send it" from her phone without opening the file, the setting would let it through.

3. A small approval system. This was the idea from the series' own worked example. The worker would lose the mailbox completely. It could only propose a send. A named person would open a small approval page, see that exact file with its figure and its open items, and approve it. The approval would be saved as a record: who, which exact version of the file, to whom, and when. It would expire, and it could be used once. Only then would the system send. The record alone would be evidence. The real control was the last step: the system would refuse to send anything that did not match a valid record (Exhibit 8).

A contractor quoted about three weeks and $6,000 to build it, then $60 a month to run. That was four months of Lakeshore's fee. Nisha's firm had three clients.

She also looked at ChatGPT's workspace agents, where sending needs a person's approval by default.6 But OpenAI's pages did not say who may give that approval in a shared channel. Changing the tool would not answer whose word the worker should take (Exhibit 2).

What each option still trusted

She wrote one more line under each option.

OptionIt still trusts
1. A better ruleThat nobody types the words without doing the check
2. A release channelThat the two approvers read the file before they type
3. An approval systemThat the approver reads what the page shows her

No option removed trust. Each one moved it to a smaller group and left a better record.

Before the end of the day

It was three in the afternoon on Monday. Hamza had come to her office at ten and said he was sorry for asking twice. She had told him the truth: on Friday he had nobody to ask but the worker, and that was her doing.

She had one email to answer, a new skill, three options, and a fourth client who would ask the same question as Dana.

She had until the end of the day to choose.

Next, The case at a glance.

Sources for the product facts in this story are given in full in the exhibits.

Check yourself

Question 1 / 5

0 answered

Why is option 1, a better rule, still weak?

  1. As verified on November 10, 2026, Anthropic says "A connector's credential belongs to that agent identity and is shared by everyone in the channels where it applies. Anyone in one of those channels can ask Claude to act with the credential". Security and data handling, Claude Tag docs, Anthropic.↑
  2. As verified on November 10, 2026, Anthropic says "What Claude can do never changes based on who asked." How agent identity works, Claude Tag docs, Anthropic.↑
  3. As verified on November 10, 2026, Anthropic says "An admin chooses where each connector applies, from every channel down to one". It also says you can narrow a credential "to one host, one path prefix, or read-only methods". Security and data handling, Claude Tag docs, Anthropic.↑
Owner
Panaversity