The demo is not the product
Agent demos are all built the same way. A goal is typed, a plan appears, tools are called, something useful happens. It is genuinely impressive and it tells you almost nothing, because the run you are watching is the run that worked.
The runs that decide whether you keep the agent are the other ones. The agent that misreads a refund policy and offers one it should not. The agent that keeps retrying something broken at four in the morning. The agent that decides the right move is to email two thousand people.
None of those are model failures exactly, a better model has fewer of them, never none. They are questions about what the surrounding system does when the model is wrong, and that is a design decision the vendor made long before you saw the demo.
Four mechanics worth more than the model
Does anything stop before it sends? The meaningful line is not “does it have guardrails”, everyone says yes, but whether an outbound message is held before it reaches a person. In ProxyAI, when an agent wants to send a message or an email, or make a call, it stops and waits. You get an email, the task appears in a Needs You list, and you can see each message it wants to send: who it goes to, the subject, and the start of the text. Approve sends everything; reject discards it.
That is a deliberately blunt instrument. Approval is all or nothing, you cannot approve three messages of five.
Is spending capped per run, not per month? A monthly budget is a bill you find out about later. A per-run cap stops the individual run that has gone wrong while it is going wrong. ProxyAI’s default is $2.00 per run, and a run that reaches it stops.
What happens when the balance is empty? This is the question nobody asks and everybody finds out. The honest answer should be a refusal, not a partial action. New agents cannot be created, runs stop with an “out of credits” error, and a customer who asks for a task in chat is told it is unavailable, rather than receiving half of something.
Does a pending decision block the next run? An agent that keeps starting scheduled runs while three approvals sit unread is manufacturing a queue you will never clear. Held runs wait seven days and then expire, and the agent does not start new scheduled runs while a decision is pending. That is less convenient and it is the correct trade.
The exception that makes it usable
A system where everything stops for approval is one nobody switches on. The exception has to be principled rather than a convenience toggle, and the principle is destination.
Two destinations never hold: a report to your own inbox, and a spreadsheet you picked yourself. Neither reaches a customer, so neither can embarrass you. That single carve-out is what lets a reporting agent run unattended from the first day while a customer-facing one stays supervised, without a setting that quietly turns supervision off everywhere.
What “human in the loop” should mean
The phrase has been worn smooth. Used carelessly it means a person exists somewhere near the system. Used precisely it means the work waits where you can see it, not yet done, until a person decides.
The test is simple: ask where you would look, right now, to see everything an agent has proposed and not yet done. If the answer is a log you would have to read after the fact, the loop is not there, you have an audit trail, which is a different and much later thing.
Start with the boring agent
The strongest argument for agents is not the most autonomous one. It is a daily summary of what happened in your store, landing in your inbox, costing a fraction of a cent, touching no customer. It is genuinely useful, and it is how you learn what the thing gets right before you let it speak to anyone.
Then move one step out: an agent that drafts replies and holds them. You read the drafts for a week. If they are good you approve them quickly; if they are not you have lost nothing.
The vendors most worth trusting are the ones whose documentation makes that progression easy to find, including the part where it says what the agent cannot do. A capability list with no limits section is a sales page.