Don't make customers approve every step; have them approve one locked job

Emil Chetty leads data and AI product at Wise. On the AI Engineer show, he argued that customers should approve a task once, as a whole. They should not approve each small action an agent takes. A payment, he said, needs proof the customer agreed to the full job. His answer is one locked approval, with ordinary software enforcing its limits.

What was said

Chetty began with coding agents. Engineers once sat watching a terminal and approving each step. In his words: "We ultimately made the human the API." Coding tools eased this with auto mode, permission rules, classifiers and sandboxes. He said these controls matter.

A payment, he argued, is a different problem. A coding agent must judge whether an action looks safe. A payment must show the customer approved this transfer, to this payee, on these terms. He said evals (tests of model behaviour) and a control harness are still needed. But they cannot show what the customer agreed to.

Wise's design works in stages. First, the agent gathers facts with read-only access. Trusted software resolves suppliers, bank details and amounts. The customer then sees a plain-language draft, backed by a machine-readable version. Once she approves and authenticates, the job is fixed. The agent may replan inside it, but different terms need a new proposal. Chetty put it simply: "We want them to agree to the job, not every step."

Chetty gave Wise's scale: over $243 billion moved across borders last year, nearly 19 million active customers and more than 80 licenses. On tricked agents, he said the boundary does not rely on the model spotting a scam.

Why it matters

Our reading: a prompt that a tired person clicks through is a weak safety control. It leans on the customer, not the system. Chetty's design puts the limit in code the company already trusts. He said this gives Wise one chain of evidence showing who authorized what.

For anyone buying or building agent features, the practical test is where the limit lives. Is it a prompt, or a rule enforced outside the model? Chetty's example was a small business owner who should not approve a hundred steps.

The other side

Chetty's case rests on a payments firm that, he said, spent years building verified software. The excerpts do not say how firms without such software would enforce limits.

His worked example was hypothetical. The excerpts give no data on whether customers read the draft carefully or just click through it. A locked job is still a click. The agent can also still choose badly inside the agreed terms.