Tools
The hands
What a worker is able to touch. Each one comes with its own limit.
A tool is anything that lets a worker act on the real world: send a message, add a calendar entry, open a web page. This is where mistakes stop being wrong words and become wrong actions.
So every tool has a rule about how far it can go. The rule is built into the tool itself, because a rule that is only written in the instructions gets forgotten.
5
ways past the browser’s protection that I found and closed myself
The tools, and the limit on each
Chat messages
Commands are accepted only from me. A reply to someone is allowed only if they wrote first and recently, and only once.
The calendar
The assistant can add entries, but only to a calendar of its own, and it cannot delete. To cancel something it marks it as cancelled.
The web browser
It can read pages for research. It cannot be pointed at machines inside my own network: I found five ways around that protection and closed them.
Email
Drafts only. It proposes, I choose, and I send.
Files and code
Every change is recorded, so any of them can be undone.
Documents
It can produce finished reports as PDF files and deliver them, with a check that the file really exists before it says so.
The phone app
An iPhone app I built to send jobs, watch them run and approve actions when I am away from the desk.
The power switch
It can wake a second computer with one simple signal. Putting it to sleep goes through a separate, narrow path that can run exactly one command.
What it taught me
- 1
Give the smallest tool that does the job. Wake and sleep look like one feature and are two different levels of trust.
- 2
Where anyone can write to the assistant, the tools that hold passwords are removed entirely.
- 3
“Please be careful” is not a safety measure. A limit the tool cannot exceed is.