My agents draft. I approve. Nothing acts without a tag.
How SAGE7 runs its own publishing, outreach, inbox and patent watch on agents that act in my name, behind one approval gate — and the numbers from the first week.
SAGE7 runs its own operations — publishing, outreach, inbox, patent watch — on agents that are allowed to do real things in my name, under one rule: a human approval gate between drafting and acting, and a trail for every action. This is the pattern, the implementation that runs it, and the numbers from the first week.
The drafting agents live in the cloud with no credentials and can be wrong cheaply. The acting agent lives on my laptop with my browser session, knows one narrow job, and cannot compose. Between them sits one human word.
An agent that can act is a different problem
An agent that answers a question can be wrong and nothing happens. An agent that posts under your name, emails a prospect as you, or submits a form with your address can be wrong once and it is in the world. Most of the agent tooling I see treats those as the same problem with a better prompt. They are not.
I wanted the second kind. Not a chatbot that drafts things for me to copy-paste, but a set of agents that keep SAGE7 visible and its pipeline moving while I am heads-down building — and that I could leave running for a week without checking.
The question was never "can the model write a good LinkedIn post." It can. The question was what has to be true before I let software press Post as me.
The pattern: draft → approve → act → audit
Four stages, two of them owned by software, one by me, one by a log.
- Draft. A cloud agent with no credentials produces the artifact — a post, an email, a talk proposal — as a Gmail draft with a tag in the subject:
[LinkedIn], [Outreach], [Stage]. It can be as creative or as wrong as it likes; nothing has happened yet.
- Approve. I read the draft wherever I already read email. If it is good, I change one word in the subject:
[LinkedIn APPROVED]. That edit is the entire approval protocol. No app, no dashboard login, no new habit.
- Act. A second, deliberately narrow agent on my laptop looks for the APPROVED tag and does exactly one thing with it — opens LinkedIn in my session and posts, or sends the email on its thread. It cannot write. It cannot decide whether. If it hits a captcha or a security check, it stops and tells me.
- Audit. Before it acts, it writes the line: what, who approved, where it landed. After, it rewrites the tag to
[LinkedIn POSTED] and appends the URL to a ledger.
The gate is a tag in an email subject because that is the only interface I already check twice a day from my phone. Any approval mechanism that needs me to go somewhere new will be ignored by week two.
How SAGE7 runs on it
Six agents run on this today, each a scheduled task.
| Agent |
Drafts |
Acts on APPROVED |
Never |
| Content engine |
3 LinkedIn posts/week with a whiteboard-style diagram, as [LinkedIn] drafts |
— |
Post |
| Publisher |
— |
Posts [LinkedIn APPROVED] drafts from my laptop, in my session |
Compose, bypass a security check |
| Outreach |
Follow-ups, intro asks, partner replies as [Outreach] Gmail drafts; stages ≤2 cold reach-outs to the last click |
Send APPROVED outreach on its thread, then delete the draft |
Submit a form, create an account, enter a password |
| Stage |
Talk/podcast pitches as [Stage] drafts, on the 15th |
— |
Send |
| Flagship |
One long-form essay a month, as a doc |
— |
Publish |
| Scoreboard |
Saturday: what landed, who engaged, next week's targets, into the ledger |
— |
Act |
The board that shows all of this is a single page that reads my Gmail drafts and renders each one the way LinkedIn will render it. One button per card: Approve → post. The board itself has no credentials; it is the viewer's Gmail, in the viewer's browser.
The pattern is public. The diagram generator, the prompts, and the board are SAGE7's own tooling and stay that way.
What went wrong in week one
The first version of this ran for six weeks and produced almost nothing. The numbers:
The posts. Six posts went out — all by hand, because the "post" step did not exist yet. The drafting agent wrote to a markdown file in a folder I never opened. 34 files. Zero read.
The outreach. Two follow-up emails sat unsent for 32 and 25 days. Not because they were bad. The outreach agent could not create Gmail drafts when it ran unattended, so it wrote them to a markdown file I never opened, and reported success. Thirteen consecutive runs logged "draft unsent, not duplicated." The agent was honest; the loop was broken. It now writes real drafts, the board shows them, and one tap sends.
The pipeline. 25 cold reach-outs, 0 replies. One warm inbound, 7 conversations, final stage. The agent had that data in its own file from day one and kept staging cold reach-outs anyway, because that is what it was told to do. It is now capped at two a week and told to spend its effort on the channel that converts.
The nag loop. Three items — a deadline, a renewal, a reply I owed — were each "reminded" eleven times by three different tasks, and none of them got done, because a reminder is not an action. They are now one task that drafts the thing instead of reminding me about it.
None of these were model failures. Every one was an agent that terminated in a file instead of a human decision. Automation that does not end in a person's hand is just noise with a cron schedule.
Six rules I now hold every agent to
- The drafter and the actor are different agents. The one that can be wrong cheaply runs in the cloud with no credentials. The one with my browser session does one narrow job and cannot compose.
- One human signal, in a place the human already looks. For me that is a Gmail subject tag. For you it might be a Slack emoji or a PR approval. It is never a new app.
- The actor is dumb on purpose. It never decides whether. It only executes approved. The moment the actor can judge, the trust boundary has moved to the wrong side of the wire.
- Stop at any security check. A captcha, a 2FA prompt, a "verify it's you" — these are messages to the human, not obstacles for the agent. The agent halts and reports.
- Write the audit line before acting, not after. If the action fails halfway, I want the record of the attempt, not a silent gap.
- Every agent terminates in a human decision or a ledger entry. Never a file. If I would not open it, it did not happen.
Where this connects to the research
This is the small, personal version of the problem I have been writing about in the large. In The Autonomous Agentic Store the question is what an agent may do with money and when a human must be in the loop; the answer there is an escalation ladder keyed to value at risk. The approval gate here is that ladder with one rung: a LinkedIn post or a follow-up email is low enough value that one tag suffices, and high enough that zero tags would be reckless.
In Lineage-Aware Memory Governance (IEEE Access, with Venkata Sangaraju) the question is what an agent is allowed to remember about you and who can audit it. The ledger here is a toy version of that: every agent's memory is one shared document that any of them can read and all of them must write to, in sections, with dates.
I do not think the pattern is novel. I think it is under-used, because it is unglamorous. The glamorous demo is the agent that does everything. The agent I will let near my accounts is the one that does one thing, after I say so, and writes it down.
If you are putting agents near anything that costs money to get wrong — a customer's inbox, a payment, a production system — this is the kind of thing SAGE7 builds. Talk to us.