Is this list the same for every agent?

The list is per action, not per agent. You might trust one agent to draft replies on its own while its stage changes still need review. The same rule covers every agent that could take that action, not only one labeled 'risky.'

Why single out suppression lists specifically?

A suppression list exists because someone asked you not to contact them, or because contact creates legal risk (bounced, unsubscribed, opted out). An agent that skips the suppression check may break a promise or a law, which is far worse than a business mistake.

Can these actions ever move to automatic?

Some can, gradually and per action class, after a clean track record in review mode. External sends generally stay in review the longest because the audience for a mistake is outside the company. Deletes and merges rarely graduate at all, since they are the hardest to reverse.

What should an AI agent never do alone?

Send anything external, spend money, delete or merge records, change a deal stage, or contact someone on a suppression list. Everything reversible and internal can run unattended.

Want to see it first? Book a demo

app.salescrew.io/inbox

The unified reply inbox with classified threads

The short answer

An AI agent should never act alone on five things. It shouldn't send anything outside (email, LinkedIn message, SMS, a marketplace proposal), spend money, delete or merge records, change a deal's stage, or contact someone on a suppression list.
Anything you can undo that stays inside can run without a person checking each one: research, tags, drafts, lead scores, summaries. A mistake there is cheap to catch, and nobody outside your team sees it.
The line to draw is whether the action shows outside the company or is hard to undo. How clever the agent seems, or how long it's run well, doesn't move that line. Either trait makes a mistake costly in a way a wrong internal tag never is.
This is a sensible default policy, not a fixed rule imposed by any one tool. Your team can widen or narrow it. The reason behind it should hold whatever system you use: outside and one-way actions need a person.

Why 'never alone' beats 'never at all'

The instinct when listing what an agent should not do is to describe entire agents as safe or risky: the research agent is fine, the outreach agent is dangerous. That framing breaks down quickly, because most agents worth building do a mix of both kinds of work in the course of one job. An agent that drafts a follow-up email is doing something reversible, low-stakes work, right up until the moment it sends that draft, which is neither reversible nor low-stakes. The agent is the same; the action changed.

That is why the list below describes action classes, not agent types. One agent can run on its own for the half of its job you can undo, and queue the other half for a person. That split is normal. It doesn't mean the agent is half-broken.

A sensible default policy

Action class and a reasonable default; teams adjust this, but the reasoning behind it should hold.

Action class	Default
Research, enrichment, tagging, logging, scoring, summaries, internal tasks, suggested contacts	Runs automatically
Classify a reply, pause a cadence on reply, suppress on unsubscribe or bounce	Runs automatically
Any external send: email, LinkedIn message, SMS or WhatsApp, marketplace proposal	Waits for review
Create a deal from a positive reply, book a meeting	Waits for review, can move to automatic after a clean track record
Stage changes, contact merge or delete	Waits for review
Any spend (credits, connects, ad budget) and anything outside the CRM	Human only, no automatic path

Why these five, specifically

Sends are on the list because the audience is outside the company; a bad draft that reaches a prospect cannot be quietly fixed the way an internal note can. Spend is on the list because it is money leaving the business on the agent's judgment alone. Deletes and merges are on the list because they are close to irreversible, a merged contact's history does not cleanly un-merge. Stage changes are on the list because they distort forecasting and can misrepresent a deal's real status to everyone downstream. Suppressed contacts are on the list because a second contact can break a promise you made or a duty the law sets.

Disclosure: SalesCrew is our product, and this exact policy table is what ships as the default, seeded on every new instance and editable in Agents → Guardrails. Every agent starts in review mode for every action class. Even after you move a class to automatic, a confidence threshold sends anything the agent is unsure about back to a person.

This is a policy per action, not per agent

Treating "the outreach agent" as risky and "the research agent" as safe misses that most agents do both kinds of work. Apply the policy to the action being taken in the moment, not to the agent's general reputation.

Questions

Is this list the same for every agent?: The list is per action, not per agent. You might trust one agent to draft replies on its own while its stage changes still need review. The same rule covers every agent that could take that action, not only one labeled 'risky.'
Why single out suppression lists specifically?: A suppression list exists because someone asked you not to contact them, or because contact creates legal risk (bounced, unsubscribed, opted out). An agent that skips the suppression check may break a promise or a law, which is far worse than a business mistake.
Can these actions ever move to automatic?: Some can, gradually and per action class, after a clean track record in review mode. External sends generally stay in review the longest because the audience for a mistake is outside the company. Deletes and merges rarely graduate at all, since they are the hardest to reverse.