The No-Touch List: 4 questions to ask an AI agent developer before you pay

This is the guide from the Cortex video on the No-Touch List. It asks the same four questions as the video, in the same order:

1. The job. Can they name the agent's job in one sentence?
2. The access. What can the agent read, what can it change, and what can it not touch at all?
3. The approval. Which actions wait for a person, and can they show you where that person approves?
4. The handover. Who owns the keys and accounts, and what expires on a schedule?

Take this page into the meeting. Each question below has the answer you want to hear and the answers that should worry you.

Why start with what the agent can't touch

The OWASP GenAI Security Project names this risk excessive agency and traces it to three causes: too much functionality, too many permissions and too much autonomy. Its fixes are equally plain. Give the agent only the functions it needs, keep its access to the least that works (read-only where possible), and require a person to approve high-impact actions.

A builder who already thinks this way will answer the four questions quickly. A builder who does not will talk about features. That difference is easy to hear across a table, even if you have never written a line of code.

Before the meeting

Write down three things so you can hold the conversation to them:

• The one task you most want off your team's plate, in your own words.
• Every piece of software that task touches (field software, CRM, phones, books).
• Who in your office would approve what the agent drafts.

The Federal Reserve Banks' 2026 report on employer firms found that 54% of small firms planning to use AI named finding tools that meet their needs as a challenge, and 43% of current users named adapting tools to their business. A short written scope is the cheapest fix for both.

Question 1, the job

Ask: "What is the one job this agent does, in one sentence?"

Good answer: a sentence with a trigger, a source and an output. For example: "When an estimate has had no reply for four days, it drafts a follow-up text and puts it in Kim's queue." Anthropic's engineering team advises builders to find the simplest solution possible and add complexity only when it is needed, and it separates fixed workflows for well-defined tasks from agents for open-ended ones. Most office work in a service company is the first kind.

Worry if you hear: "It handles your whole back office," or a list of ten features with no first one picked.

Question 2, the access

Ask: "What will it read, what will it be able to change, and what will it have no access to?"

Good answer: a short list, by system, that matches the job. A follow-up agent reads estimates and customers, writes drafts, and has no access to invoices or payroll. Where the software allows it, access is read-only. For example, ServiceTitan lets an admin choose an app's scopes when it is registered in the developer portal, so a narrow scope is a choice, not a favour.

Worry if you hear: "We'll need your admin login," or "full access is easier for now."

A quick test: ask them to name one thing the agent will never be able to do. If they can't, the answer to question 2 is "everything".

Question 3, the approval

Ask: "Which actions wait for a person, and can you show me where they approve?"

Good answer: anything that reaches a customer or touches money waits for a named person, at least at the start, and they can show you the screen, the queue or the message where that person clicks approve. OWASP lists human approval for high-impact actions among its fixes for excessive agency. Over time, low-risk drafts that are never edited can go out on their own, one type at a time.

Worry if you hear: "It's fully autonomous," or "you can turn approvals on later."

We describe how we set this up in human-in-the-loop AI and our defaults on trust and security.

Question 4, the handover

Ask: "If we stop working together, what do we keep, who owns the keys, and what expires?"

Good answer: the accounts, API apps and keys are created under your company, not the builder's. You get a written list of every connection, where its secret is stored, and which ones expire. Some tokens need routine care: HubSpot, for example, recommends rotating private app tokens every six months. A good builder names those dates before you ask.

Worry if you hear: "We host everything on our side," with no export, or no list of what expires.

A one-page scoring sheet

Score each answer 0, 1 or 2 during the meeting.

Question	0	1	2
The job	No single job	A job, but vague	One sentence with trigger, source and output
The access	Admin login or full access	Narrower, but no "never" list	By system, read-only where possible, a clear "never" list
The approval	Fully autonomous	Approvals "available"	Named approver, shown on screen
The handover	Builder owns the accounts	Some keys in your name	Everything in your name, written list, expiry dates

A builder who scores 7 or 8 is worth a second meeting. Below 5, keep looking. The scale is ours, built from the questions above, not an industry standard.

After the meeting

Ask for the four answers in writing before you sign anything. They become the first page of the scope, and they are what you check the finished build against. If you want to see how a build is scoped end to end, read custom AI agent development: what a service business should expect. If you would like a second opinion on where an agent fits your business first, your free AI Operations Audit covers it.