How much should an AI assistant do without asking?

The right amount depends on the action, not on the assistant. Set autonomy per kind of action, because the risks are very different: archiving a newsletter is easy to undo, while emailing your landlord or canceling a contract is not.

Three questions decide where an action belongs. Can it be undone? Does it reach another person? Does it cost money? The more yes answers, the more approval it needs. Adding a calendar entry for yourself sits near the low-risk end. Paying an invoice or messaging a client sits at the other.

A single global setting fails in both directions. “Ask about everything” makes the assistant tiring to use, so you stop reading what you approve. “Never ask” makes one wrong guess expensive. Per-action settings avoid both.

Gravel uses four levels, chosen separately for each kind of action.

Most people end up with a mix. The defaults in Gravel are conservative: anything that reaches other people or costs money asks first, and payments and purchases are handed to you. You can change the level for any kind of action at any time.

Because trust should come before access. A read-only assistant can only misjudge in one direction: it can tell you something wrong or unimportant. It cannot send a wrong email or move a wrong appointment. That makes the first weeks a low-stakes test of whether its judgment matches yours. If it keeps surfacing the right things, you have a reason to give it more. If it does not, you have lost nothing.

Gravel connects read-only. The first time an action needs more access, such as sending a reply from your mailbox, it asks for that permission and comes back with the confirmation for the action you wanted. You grant write access when something first needs it, not up front, so you are never handing over more than the job requires.

Anything with money, a contract, a deletion or another person's inbox attached should always need your approval. In Gravel, payments, purchases, cancellations, forwarding, deletions and messages to other people can never be set to just do it. A message goes out in your name only after you approved that exact text.

A fixed risk check also runs before every action, and it can only make the rule stricter. Even at the most permissive setting, Gravel asks when money is involved, when a recipient is new or appeared only in someone else's email, when many items are affected, or when the website is unfamiliar. The AI does not control that check. Look for the same kind of floor in any assistant you try: limits that no setting can lower.

Yes, and it is a better way to loosen settings than guessing in advance. Gravel can offer to stop asking after you have said yes to the same narrow kind of action several times (five, at the moment) with no edit or refusal in between. This is new in early access.

If you accept, Gravel does that action by itself from then on, after a two-minute window in which you can undo it, and sends a receipt with proof. An edit, an undo or a complaint takes it back to asking first. The offer is limited to low-risk actions, starting with calendar entries that have no guests. Anything involving money, contracts, deletions or messages to other people is never offered.

Start strict and loosen one kind of action at a time.

1. Begin with everything on ask me first, except payments, which stay handed to you.
2. Notice which confirmations you approve without reading. Those are the candidates for just do it.
3. Loosen those one at a time, and keep anything that reaches other people on ask me first.
4. Review what the assistant did. In Gravel, ask “what did you look at today?” to see what it read and did.
5. Know your off switch. Text “pause” and Gravel stops all background work until you say so.

Revisit the settings after a few weeks. The goal is not maximum automation. It is an assistant that asks exactly as often as you would want a person to.