Your AI system needs brakes before it needs more agents

The least exciting AI story of the week might be the most important one.

Not the new voice model. Not the agent demo. Not another benchmark chart with a line so steep it looks like a stock scam.

The boring bit: limits.

OpenAI now has Enterprise and Edu documentation explaining monthly usage limits, group and user overrides, shared credit pools, overage settings and usage alerts. There is a detail in there most business owners should read twice. By default, a workspace overage limit can be set to “No limit”, which means eligible usage can keep running after your committed credits are gone, quietly adding charges while everyone assumes the meter stopped.

That is not headline material. It is just useful.

Because once AI moves from chat toy to business infrastructure, the question changes.

It stops being “can the model do this?” and becomes a much less fun list. Who is allowed to run it? What can it access? What can it spend? What can it publish, send or change? What gets logged? Who approves the risky bits? And the one people skip entirely: how does the thing stop?

That last question is going to matter far more than most people think.

Capability is getting ahead of control

The industry is still mostly selling capability. Better voice, better coding, better agents, better memory, longer tasks, more tools, more autonomy. Fair enough. Some of it is genuinely impressive.

OpenAI’s GPT-Live is a good example. The new voice model is built for full-duplex conversation, so it can listen and talk at the same time, keep a conversation going while handing harder work to another model in the background, and handle interruptions properly. OpenAI says it applies safeguards while speaking and is measuring things like emotional reliance after launch.

That is a real shift. Voice AI stops feeling like a call-and-response machine and starts feeling like something that is always there.

Which is exactly why the brakes matter.

A text chatbot makes a mistake and you can usually slow down, re-read, copy, check, delete. A voice agent makes its mistakes live, mid-sentence. A background agent makes them while you are doing something else. A workflow agent can spend credits, touch files, draft messages, query data, create tasks and trigger approvals, then hand you a tidy summary that hides the messy bits.

This is where the cheerful demo version of AI starts to look a bit thin.

The new feature is the stop condition

Anthropic published research this week on something it calls GRAM: a possible way to build removable compartments for dual-use knowledge inside a model.

The simple version. Some knowledge is useful and dangerous at the same time. Cybersecurity knowledge patches systems or exploits them. Virology knowledge helps researchers or bad actors. Anthropic’s work explores whether certain categories can be routed into modules that get switched on or off, rather than relying only on refusal training or an external classifier saying “no”.

Important caveat, and Anthropic is clear about it: this is preliminary research. It has not been applied to production Claude models, and they are not sure it ever will be. So do not go quoting it as a feature you can buy.

But the framing matters. For years, AI safety mostly sounded like “teach the model to refuse”. Now the conversation is edging towards something stronger: maybe some capabilities need access control built deeper in. Maybe the model should not merely say no. Maybe, in some modes, it should not have the capability available at all.

That is a proper brake.

And the same pattern applies much further down, inside normal businesses. A marketing agent does not need permanent access to every customer record. A sales research agent does not need write access to the CRM. A content workflow does not need permission to publish without a human reading it first. A reporting agent does not need to run forever because someone forgot to cap the workspace.

Nobody needs Anthropic-style model surgery to run a marketing team. The lesson is smaller and more practical: useful AI systems need different levels of stopping power.

Benchmarks need brakes too

OpenAI also audited SWE-Bench Pro, a benchmark used to measure agentic coding. Their finding: roughly 30% of the public tasks appear to be broken. Overly strict tests, underspecified prompts, low-coverage tests, misleading instructions. In other words, the benchmark could mark good work as bad, bad work as good, or nudge models towards the wrong behaviour entirely.

That is not a small wobble, and it matters well beyond coding.

Most businesses are going to build their own informal evals whether they call them that or not. They will ask AI to qualify leads, summarise calls, draft proposals, score opportunities, write articles, check claims, answer support questions, reconcile data. Then someone will ask the obvious question: “Is it good enough?”

If the test is poor, the answer is worthless. A bad evaluation is worse than none, because it hands you fake confidence. You think the workflow is safe because it passed. Really, it passed a broken test.

This is why the proof layer matters. You need checks that reflect the actual job, not a tidy proxy. Edge cases. Human review. Examples of failure. A way to see whether the system was right for the right reason, or just lucky.

Boring? Yes. Also the difference between a useful AI operating system and a slop cannon with dashboards.

Background agents turn governance into plumbing

The Claude Cowork coverage is another useful signal. InfoWorld reported that Anthropic is expanding Cowork to web and mobile beta, so people can monitor long-running tasks, respond to approval requests and resume sessions across devices. The same piece said Anthropic analysed 1.2 million anonymised Cowork sessions between 11 and 31 May, with business process and operations accounting for 33.4% of usage, ahead of content and copywriting at 16.4%, and software development lower at 8.7%.

Treat those numbers gently. That is reported coverage, not a primary source I could verify this morning. But the direction feels right. Agents are not staying inside developer demos. They are drifting into operations.

That changes the management problem. If an agent is doing research in a tab while you watch, you can babysit it. If it is running in the background against your business systems, across devices, with approval prompts turning up later, then governance is no longer a policy PDF. It is product plumbing. Identity. Least privilege. Audit trails. Approval workflows. Spend caps. Session logs. Tool permissions. Rollback. Escalation.

Unsexy again. Sorry. That is the work.

The brake map every business needs

If I were reviewing a business AI stack right now, I would ask for a brake map. Not a model list. Not a prompt library. Not a slide with logos on it. A map of how everything stops.

Spending brakes. Where can AI usage create cost? Model calls, agent runs, credits, API usage, data enrichment, browser sessions, transcription, image and video generation, storage, third-party tools, overages. For each one: is there a monthly cap, who can raise it, is there an alert before it hits the wall, and what happens when it runs out? Can one person burn the whole shared pool? Are overages disabled, capped, or wide open? If the answer is “we trust people to be sensible”, that is not a control. That is a vibe.

Access brakes. What can the agent actually see? Most companies talk about AI access like it is one switch. It is not. Public web pages are not internal docs. Internal docs are not customer records. Customer records are not billing, legal, HR, credentials and private board material. You want lanes: public, internal, sensitive, regulated, never-send. It does not need to be theatrical. It just needs to exist.

Action brakes. What can it do, not just see? Reading a document is one risk. Editing it is another. Sending an email, publishing to a site, changing CRM records, spending money: each one is a bigger step. Draft is fine. Suggest is fine. Queue for approval is fine. Direct execution should be rare, scoped and logged. My rule for most SMBs is blunt: if the action touches a customer, money, legal exposure, a public claim or a permanent record, a human approves it. Yes, that slows things down. Good.

Quality brakes. How do you know the output is any good? This is where the SWE-Bench Pro audit earns its keep. Businesses will make the same mistake the benchmark did. They will test a support bot with five polite questions and call it safe. They will test a proposal writer on one easy client and assume it understands the offer. Real quality brakes need real examples: good inputs and bad, easy cases and awkward ones, known traps, and answers where the right response is “I do not know”. If your eval cannot fail the system, it is not an eval. It is a comfort blanket.

Publication brakes. AI content workflows especially need this. The internet does not need more confident nonsense, and clients do not need more posts that sound polished and say nothing. Before anything goes public: are the claims sourced, are the numbers real, is the customer language accurate, is it useful without the AI novelty, and would we happily defend it to the client? If not, it stays in draft.

Relationship brakes. This one grows with voice. OpenAI’s GPT-Live work includes voice-specific safety testing around self-harm, psychosis and mania, emotional reliance, violence and sexual content. That tells you the interface itself changes the risk. A natural voice can feel more intimate than a text box. It can sit in someone’s ear on a commute. For many uses that is handy. For some it is dangerous. Businesses using voice AI will need rules around escalation, sensitive topics, vulnerable users, consent, recording and handoff to a human. You cannot treat voice as just another input field.

What this means for agencies

This is where the post-agency argument gets sharper.

The old agency model sold output: campaigns, pages, ads, posts, reports, decks. The lazy AI agency sells faster output: more of all of it, vaguely smelling of the same model. That is not enough.

If AI is becoming part of the commercial operating system, the valuable work is building the controlled layer around it. For marketing that means client-owned memory and context, clear data rules, source-backed content workflows, approval gates before publication, attribution that connects spend to revenue rather than clicks, search visibility work with receipts instead of AEO theatre, agent tools that can act safely on sites, CRM records and analytics, and logs that show what happened when something breaks.

The Perpetual Traffic note from this week is a useful reminder. A premium home-wellness brand was reportedly spending around $115k a month without clean proof of what worked, partly because offline revenue events were never connected back into the ad platforms. On the surface that is not an AI problem. But it is exactly the kind of thing AI makes worse if the measurement layer is broken.

So: if you cannot connect spend to revenue, do not automate the spend decision. If you cannot prove which claims are true, do not automate publication. If you cannot see which data the agent touched, do not give it broader access. More velocity does not fix weak controls. It just creates faster mess.

A simple owner checklist

Before adding another agent to the business, answer these.

1. What is this AI workflow allowed to do without approval?
2. What is it never allowed to do?
3. What data can it read?
4. What systems can it write to?
5. What can it spend, per user, per workflow, per month?
6. What evidence proves the output is correct?
7. Where are the logs?
8. Who reviews failures?
9. How do we roll it back or stop it?
10. What happens when the model, benchmark, vendor or price changes?

If those questions feel heavy, that is the point. AI is being sold as light work: click, prompt, automate, scale. Real adoption is heavier. It drags in governance, data ownership, budgets, approvals, measurement, security and judgement. The businesses that accept that early move faster later, because they are not forever cleaning up invisible mess.

The Foundry angle

Here is the line I keep coming back to. AI does not transform marketing because it produces more content. It transforms marketing when the commercial system becomes faster, more responsive, more evidenced and more controlled.

Controlled does not mean slow. It means the business actually knows what is happening. It knows what the agent can access. It knows where the money is going. It knows which claims are sourced. It knows which model handled which job. It knows when a human has to approve. It knows how to stop.

That is the post-agency opportunity. Not “we use AI”. Not “we make more stuff”. Build the operating layer. Put the brakes in. Then make it move.

---

Jason Sibley is the founder of Cleo, a post-agency marketing and AI company. JasonVsTheNoise is where he writes about what is actually happening with AI, marketing, and how businesses should be thinking about both.