Part three of building FamilyLine, my family’s AI agent, over four weekends. Weekend one gave it a warm bilingual voice. Weekend two is where it stopped being a chatbot and became an agent — and where I settled the question that matters most once an agent can act on its own: how do you make that safe?
Answering vs. noticing
A chatbot waits to be asked. An agent notices something and offers to help. That difference is the entire jump.
So I gave the bot a memory. As the family chats, it quietly extracts durable facts and commitments — “I’ll book the dentist”, “the car’s due for servicing”, “grandma’s visiting next month” — and stores them. Then a small planner started doing something new: instead of waiting, it began proposing. “Want me to set a reminder for the dentist on Thursday?”
The moment an agent starts suggesting actions, you’ve crossed a line. The interesting question is no longer “can it?” — it’s “what happens when it’s wrong?”
The gate: propose, then a human approves, then it acts
Here’s the pattern I’d reuse in any agent I ever build, and the thing I’m proudest of in this whole project: the agent never acts on its own.
Every action the agent wants to take — set a reminder, add a calendar event, anything with a side-effect — doesn’t just happen. It becomes a proposal with an Approve / Not now pair of buttons in the chat. The model can suggest anything it likes; it can only do the things a human tapped Approve on. And every one of those approvals is logged.
That single seam does an enormous amount of work:
- Suggestions are cheap and reversible. A bad suggestion is mildly annoying; you tap “Not now” and move on. Nothing broke.
- Actions are gated and auditable. Nothing with consequences happens without a human in the loop, and there’s a record of who approved what.
- It fails safe. When the model is confidently wrong — and it will be — the worst case is a declined suggestion, not a wrong calendar invite sent to the whole family.
This is what made me comfortable putting an autonomous-ish agent into a chat my kids use. The autonomy is real, but it’s bounded at exactly the point where mistakes get expensive.
Why this beats “just make the model more careful”
The tempting alternative is to trust a well-prompted model to only act when it’s sure. But “sure” is exactly the thing large language models are worst at judging. Confidence and correctness aren’t the same signal, and building your safety on the model’s self-assessment means your safety is only as good as its worst hallucination.
A permission gate doesn’t care how confident the model is. It moves the decision to the one party who actually bears the consequences — the human. You stop trying to make the model trustworthy and instead make the system trustworthy, which is a much easier and much sturdier problem.
The takeaway
Put a gate between “the model wants to” and “it did.” Let the agent notice, remember, and propose freely — that’s where the value is. But keep every real action behind a human tap, and log it. That one architectural seam is the difference between a helpful agent and a liability, and it’s what lets you hand real autonomy to the people you care about without holding your breath.
Next: weekend three, the travel agent — and a related principle that kept it useful and safe. It finds you flights and hotels, and then it deliberately stops. Find, surface, hand off — never transact.
Part of a personal DIY hobby, tinkered together on weekends for my own family — not a product or a venture, and built entirely with open-source, self-hosted models.
Leave a Reply