A job description for a new colleague

Imagine a bright, eager new colleague on their first day. They work fast, but they have no idea how your household or office runs, and they believe most of what they read.

You would not hand them a one-line note. You would tell them what the job is for, what they may and may not do, and when to come and find you. Hello, AI suggests treating an agent the same way.

A chat prompt asks for an answer. A brief hands over a job, and a job needs more.

The four parts of a brief

The goal. Say what you want and why. “Book a birthday dinner for Mom on Saturday” is a goal. Add the details a stranger would miss: she loves Thai food and hates loud rooms.

The limits. Give it a budget and a boundary. “Under $200 for four” works like a credit card limit on a personal assistant. Hello, AI points out that in that arrangement the hard limit does more safety work than the trust does.

What done looks like. Describe the finished result. “A table held for 8pm, and a short note telling me what you chose and why.” Without this, an agent can stop too early or keep going too long.

When to stop and ask. Name the steps that need your yes: booking, paying, sending, deleting. Ask it to come back too if it gets stuck or finds something surprising.

Start with reading

Hello, AI offers a trust ladder, sorted by how much damage a mistake could do. Research and comparison sit at the bottom: the worst case is a wasted errand. Reservations and drafted messages sit in the middle, where you check before they count. Spending without confirming each purchase, your bank or medical accounts, and messages sent in your name unread stay with you.

Climb one rung at a time. Let it read before it drafts, draft before it sends, and send before it spends. As The Helpers You Can’t See puts it, an agent can draft your email, and a person should hit send when it matters.

Only the keys it needs

Anything an agent reads goes into the same window as your instructions. A web page or an email can hide its own instructions, and the agent may follow them. This is called prompt injection. When Anthropic attacked its own browser agent on purpose in 2025, 11.2% of the attacks still worked with its defenses switched on.

So the safest brief also limits access. Give the agent only the tools and sites the job needs. Keep it in a separate browser profile, with no password vault open in the next tab. A tricked agent can only do what its access allows.

Personal data matters too: an agent in your inbox sees information about you and about other people. On 8 October 2026 the UK’s data regulator, the ICO, asked for evidence on how organisations manage the data protection risks of AI agents, with responses due by 20 November. Its director of technology regulation said “the fact AI agents act with autonomy is not an excuse for poor compliance.”

Try it this week

Pick one low-risk errand, such as comparing two phone plans’ yearly cost with links. Write the brief in four lines: goal, limits, what done looks like, when to ask. Then open the agent’s permission settings and read what it is allowed to touch. Finish by writing your own red list: the accounts and actions no agent gets from you this year.

In one sentence: brief an agent like a careful new colleague, with a goal, limits, a picture of done and a rule for when to ask, and give it only the access that job needs.