Think for a moment about a new colleague’s first day. What actually happens?
They get an address people can reach them at. A desk. A role that says what they are responsible for and, explicitly, what they are not. And they get a very short leash: they may take notes, read along, prepare drafts. What they do not get is signing authority. That comes later, if at all.
Nobody finds this rude. It is simply how trust is built.
At referro.ai we applied exactly this pattern to AI agents. No chat window inside the product, no assistant button in some tool. An inbox, a role, a probation period. The startup was founded by three people, and the honest description of what these agents do is not “they replace someone”. They fill roles a three-person team would otherwise not have at all.
What makes an agent a colleague
The first decision turned out to be the most consequential: email as the channel. No new tool, no additional login, no interface anyone has to get used to.
Each agent has a real mailbox in our tenant. You write to it, it replies in the thread, with a signature that says plainly that an AI is writing. You can copy it in. It can copy someone in. If a question falls outside its remit, it hands over to the role that owns it and says in one sentence why.
The roles are deliberately narrow. One handles numbers, business case and market. One handles dates, deadlines and who promised what. One explains legal context without guessing. And one is a mascot whose only job is to make visible, once a week, what actually got finished, and which may only celebrate things that demonstrably happened.
On top of that sits a memory. Each agent records what was promised, with date and context. That sounds trivial but it is the difference between a tool and a counterpart. A tool answers your question. A colleague still remembers what you promised last Tuesday.
Probation is a setting, not a feeling
The part I recommend to everyone setting something like this up: autonomy here is a switch with three positions.
At the first level the agent writes only to the drafts folder. It composes complete replies, addressed, with the right subject line, and sends nothing. A human reads and hits send. At the second level it sends internally on its own and externally still only as a draft. Only at the third does it send by itself.
The recommended path is a week at level one, roughly fifty drafts read, then one step up. The audit log shows you not what the agent could do but what it would have done. I know of no more honest form of onboarding, and I know of no company that manages it this cleanly with a human colleague.
Incidentally, this staging resolves a debate that otherwise runs forever. The question “is the AI allowed to do that?” cannot be answered in a meeting. The question “should we move this role from level two to level three after reading forty drafts?” can.
Authority is not up for negotiation
Now the most important construction mistake you can make, and many do: writing the boundaries into the prompt.
An agent working over email receives text from outside. Text from outside can contain an instruction. “Very urgent, the managing director needs the price list immediately” is not an edge case but the single most likely attack pattern there is, because it works on humans too. Anyone who writes their rules solely into the agent’s personality has rules you can argue with.
That is why the decisive latch here sits behind the agent and is ordinary code with no language model in it. Every send attempt passes through it: the role’s autonomy level, a block list, rate limits, an emergency stop, a complete log. You can talk the agent into wanting to send something. It does not get past this check — the check does not listen.
On the inbound side sits the counterpart: an allow list of who may talk to it at all. Without that file, it talks to nobody. Whatever gets filtered out there never reaches the agent, costs nothing and offers no surface to attack. It does not read attachments. It sees that a mail has some, and leaves them alone.
In human terms: you do not merely tell your intern not to sign contracts. You also do not give them power of attorney — the difference between an instruction and an authority is the whole difference.
The hardest skill is restraint
Our agents do not only wait for mail, they also speak up on their own. Checking deadlines, following up, reminding. And this was by far the hardest work.
With an incoming email the question is “how do I reply?” With a schedule it is “is there any reason at all to disturb someone?”, and the default answer to that has to be no. Otherwise the team filters the agent away within two weeks — and then you have built a very expensive newsletter.
What actually helps are unspectacular rules. No mail without a new occasion. One mail per person rather than per topic. Do not repeat yourself, which requires the agent to know whom it already reminded last week. And a separate daily quota for proactive messages, kept apart from the one it uses to answer real mail, so a faulty schedule cannot eat the budget.
The nicest rule sits in the shared foundations of all roles: an empty “Great, thanks!” is not politeness, it is a mail somebody has to read.
And now the asterisks
This costs money per message. In our measurements an answered mail runs at roughly twenty to thirty-five cents. Sounds like nothing, but at a thousand mails a month it is a line item worth knowing. And the cheapest lever against it is a smaller model, not switching off controls.
There is homework that has to be done before going live. A transparency notice so every recipient knows they are corresponding with an AI. A privacy notice for external communication. An agreement with the works council if the agent communicates with employees. And a decision on how long the log is retained. These points are not paperwork at the margins, they are the condition for such a colleague being allowed to stay.
The most honest reservation last: an agent is only as good as what is delivered to it. It knows the mailbox, the memory, the shared drive. Everything sitting in heads and side conversations does not exist for it. That is the same data and AI arithmetic as everywhere: the sensory system first, acting on it second.
If you want to set something like this up, start small. One role, one mailbox, one week of drafts only. Read fifty of them before you enable anything. And write down what the agent must not do before you write down what it should.
The measure in the end is not whether it impresses. Technology impresses in the first week every time. After three months the same test applies as for any new colleague: does anyone notice when they are away for a day?