Auto, approval, explicit: the three tiers that make autonomy safe
Why a flat "ask every time" model fails
An agent that asks your permission before every single action would be as slow as doing the task yourself. An agent that never asks would be one you can never trust. The solution is a tiered model that matches the level of interruption to the level of risk — so routine steps run quietly while consequential ones never proceed silently.
Tier 1: automatic (routine, read-only)
Actions that are observable, reversible, and carry no meaningful risk run without interruption. Examples include reading a page, navigating to a URL, searching for a file, scrolling a list, or switching between tabs. These steps are what your time gets spent on when you do tasks manually; automating them is the whole point.
Tier 2: approval (sensitive, reversible)
Actions that interact with your accounts, send information across a network, or make changes that are recoverable but non-trivial trigger a one-tap approval on your screen or phone. Examples include opening a draft email, submitting a non-financial web form, or downloading a file to a specific location. BackBrain shows you exactly what it is about to do and waits for a single tap before proceeding.
Tier 3: explicit confirmation (irreversible or financial)
Actions that are difficult or impossible to undo, involve money, or affect critical data require your typed confirmation — never just a tap. Sending an email, submitting a filing, making a purchase, or permanently deleting a file all fall here. The confirmation prompt is specific: it shows the action, the target, and the amount or quantity so you know exactly what you are agreeing to.
This tier can never be pre-approved in bulk or inherited from an earlier "yes." Each consequential action asks freshly.
The deny-floor the AI cannot override
The tier classification and the approval gates are not suggestions to the AI — they are enforced in a separate deterministic layer that runs outside the AI model's reach. The model can propose any action it likes; it can never approve its own risky one. Even if a prompt-injection attack in a website's content tried to instruct BackBrain to skip an approval, the policy floor would block it before it executed.
Deletion without your explicit instruction is blocked at this floor, permanently and unconditionally.
Tier classification in practice
- Reading your bank balance — Tier 1, automatic. No risk, no interruption.
- Downloading a statement — Tier 2, one-tap approval. Reversible (file can be deleted), but you should know it happened.
- Sending the statement to your accountant — Tier 3, explicit confirmation. The send cannot be unsent.
- Filing a tax return — Tier 3, explicit confirmation. Irreversible government submission.
- Making a purchase — Tier 3, and additionally requires a pre-authorised spending mandate specifying the merchant, maximum amount, and expiry before BackBrain is permitted to attempt it at all.
Every tier classification and every approval response is permanently recorded in BackBrain's tamper-evident audit trail — so you can verify exactly which steps ran automatically and which required your input.
Get BackBrain to do this for you
BackBrain is in free private beta for Windows and Android. Reserve early access.
Reserve Early Access — hello@backbrain.inFrequently asked questions
Can I change which tier an action falls into?
You can promote actions to a higher tier (require more confirmation than the default) but not demote irreversible or financial actions below Tier 3. The safety floor is not configurable downward.
What stops the AI from classifying a risky action as routine?
The tier rules are enforced in a separate deterministic layer outside the AI's reach. The AI proposes; it cannot classify or approve its own action.
Does every send or submit require typed confirmation?
Yes. Any action that is difficult to reverse — sending an email, submitting a form, filing a document — always requires explicit typed confirmation, regardless of what was approved earlier in the same run.