Zapier rebuilt its AI agent's permission system three times. Rules now attach to the folder or app, not the tool

Zapier published an honest account of how its Sidekick agent learned when to ask before acting, including what it got wrong.

What happened

Zapier engineer Jay Ayinla wrote up how the team built permissions for Sidekick, Zapier's AI workspace. The first version let reads run on their own and stopped every write with a card offering Block, Once or Always. Problems piled up: approvals lived only in the open browser tab, "Always" was forgotten on refresh, and harmless steps triggered so many cards that the important questions got lost. Zapier's point is that when an agent asks every time, people click yes on reflex and the questions protect nobody.

The second rebuild moved rules from the tool to the thing being protected: a file, a connected app, a website or an automation. A "never" rule always wins, then "ask first", and only if nothing blocks it does Sidekick act. The agent is also not allowed to propose a blanket "allow all code execution" rule. Later the team added an Auto mode, where an AI reviewer judges only the actions your rules do not cover. A plain allow everything mode was retired in mid October. In the mode Zapier is building now, anything that reaches outside Sidekick, like sending a message, asks first, and agreeing to legal terms or making payments is never allowed. One more lesson: their first plain English instruction made the reviewer ask before a simple search of the user's own files, so they now test written rules against real actions.

My take

This matches what I see in client builds. Approval steps fail when they guard the tool instead of the risk. "Can this agent use the CRM?" is the wrong question. "Can it email a customer, change a deal stage or delete a contact?" is the right one.

What I take from this for agent workflows:

1. Write the rules around resources: which pipeline, which inbox, which folder.
2. Make deny rules beat everything, and keep them deterministic, not model judged.
3. Show approvers what will happen in plain words, with the real scope underneath.
4. Send approvals to where people already are, like Slack, and keep them after a refresh.
5. Never allow payments or anything that binds the client legally without a human.

If your approval cards get clicked without being read, the system is not protecting anyone yet.