Notes from building an AI copilot for freight dispatch
TL;DR: Every few weeks, another "AI agent" launches that can act on someone's behalf — booking things, sending things, updating things. The interesting engineering question isn't "what can it do?" It's "where should we draw the line, and why?" This post is about how we thought through that line while building the AI assistant inside LoadConnect, a dispatch tool that helps truck carriers and dispatchers analyze loads, rate confirmations, and carrier information.
The wrong question
When people talk about AI agents, the conversation usually starts with capability.
Can it read a document? Fill out a form? Call an API and take an action without a human in the loop?
That's a fun question to build for. It's also, in my experience, the wrong first question.
A more useful question is: what does the agent have access to, what can it do with that access, and what happens when it gets something wrong?
These are related, but they're not the same thing:
- Capability - what the model can understand, generate, or reason about.
- Access - what data, sessions, and systems the agent can technically reach.
- Autonomy - what the agent is allowed to do with that access without human confirmation.
You can have a highly capable model with almost no autonomy - it analyzes and recommends, but never acts. You can also have a relatively simple system with dangerously high autonomy because it can make changes on its own.
So the risk profile isn't determined by model capability alone. It depends on the combination of access, autonomy, likelihood of failure, and potential impact.
Two axes, not one
Capability still matters, but it's not the main architectural lever we can control. For the system we were building, the most useful way to reason about risk was to map access and autonomy separately:
Low Access + Low Autonomy → Low Risk
Low Access + High Autonomy → Moderate Risk
High Access + Low Autonomy → Moderate Risk
High Access + High Autonomy → High Risk
The dangerous quadrant isn't necessarily "highly intelligent AI." It's a system that combines broad access with broad autonomy.
Capability affects how well an agent can perform a task - and how sophisticated its mistakes might be. But access and autonomy determine how far those mistakes can propagate.
A highly capable model with access limited to a single document and no ability to take external actions has a relatively small blast radius. A much simpler system can become significantly riskier if it can access sensitive data and make irreversible changes without confirmation.
That distinction became one of the most useful mental models for us when deciding what our assistant should - and shouldn't - be allowed to do.
Why this isn't abstract in freight
Dispatch is a good stress test for this idea because the cost of a wrong autonomous action is immediate and expensive. If an agent misreads a rate confirmation and books the wrong appointment window, that's not a UX bug - it's a missed delivery, a detention fee, or even a damaged relationship with a broker.
So when we were designing the AI assistant, "what should it be allowed to decide on its own" wasn't a philosophical question - it was a product requirement with real financial consequences.
Consider a rate confirmation. Before signing or otherwise accepting the final terms, the dispatcher reviews it to verify that it matches the negotiated load. The assistant helps with the understanding part - extracting the rate and mileage, calculating RPM, flagging detention terms, catching inconsistencies between the document and the load details, summarizing what deserves attention. It does not touch the commitment part - it doesn't accept the load, message the broker, change the appointment, or modify the booking on the carrier's behalf.
The distinction isn't about whether the model could technically perform those actions. It's about whether the system should give the model the permissions required to perform them. We want the assistant to reduce the work required to make a decision - without quietly becoming the decision-maker.
That split turned into two separate design decisions we now make independently for every feature:
- What information does this feature actually need to see to do its job - not what would be convenient, but the minimum required.
- What is the agent allowed to do with what it finds - surface it, or act on it?
Treating these as one decision ("give it access and let it be smart about the rest") is, in my opinion, where most agent projects get into trouble.
Access: a deliberately narrow scope
The basic architecture is intentionally boring:
User selects a document or load
↓
Relevant content is extracted
↓
Scoped AI task is created
↓
AI analyzes the available information
↓
Recommendation / result is returned
↓
Human decides what happens next
The important part is what isn't in this flow. The agent doesn't get access to the user's authenticated browser session, cookies, or credentials. It doesn't continuously observe other tabs or websites. It doesn't have a general-purpose action layer that can execute arbitrary changes.
A simplified permission model looks more like this:
AI Assistant
├── Read selected document
├── Analyze extracted data
├── Calculate relevant metrics
└── Recommend an action
✕ Access credentials
✕ Read unrelated browser sessions
✕ Monitor activity in the background
✕ Send external messages
✕ Book or modify loads
✕ Change external systems
This creates a useful property: even if the model produces an unexpected output, the set of things that output can affect is already constrained by the architecture - not by a rule the model is trusted to follow.
The instinct when building an assistant is to wire it into everything, because more context makes the model perform better in demos. The problem is that "better in demos" and "safe in production" can pull in opposite directions. The rule we settled on is simple to state and annoying to actually follow: an agent should only touch what its current task needs, for as long as the task requires it. No background processes, no session or credential access, no cross-site visibility, no accumulating data "because it might be useful later."
None of this is exotic security engineering - it's mostly saying no to permissions during the design phase instead of restricting them with policy afterward. Saying no early is a lot cheaper than walking back scope creep once a feature ships and people depend on it.
Autonomy: think in terms of blast radius, not just error rate
The second axis is where it gets more interesting, because autonomy is about trust as much as it is about architecture.
There's a meaningful difference between an agent that says "this rate confirmation has a mismatched detention clause, you should look at it," and one that silently updates the record itself. Both use the same model. Both might even be equally reliable most of the time. But only one of them leaves a human in a position to catch the cases where the model is wrong before that mistake becomes a real-world consequence.
Not every model error has the same consequence, so it's worth separating capability from what happens when that capability fails:
- Extract information → Misreads a rate → Incorrect recommendation
- Calculate RPM → Uses the wrong mileage → Poor dispatch decision
- Flag a contract issue → Misses a clause → Risk goes unnoticed
- Send a broker message → Sends incorrect information → External commitment
- Change an appointment → Picks the wrong time → Operational disruption
- Book a load → Selects the wrong load → Financial and reputational impact
A wrong recommendation can be reviewed and may be caught before it produces an external consequence. A wrong external action may already have created a commitment before anyone notices. That's why we think about autonomy partly in terms of reversibility: the more consequential or irreversible an action is, the stronger the case for keeping a human confirmation step - regardless of how confident the model is.
A useful rule of thumb that came out of this: analyze → recommend → confirm → execute. The first two steps are where an AI assistant provides real leverage. The last two are where human responsibility stays, on purpose.
That doesn't mean every AI action needs a confirmation dialog - low-risk, reversible operations can often run on their own. But when an action creates an external commitment or is hard to reverse, the default should be human confirmation. The question isn't "can the model do this?" It's "what happens if the model is wrong and nobody stops it?" That question changes the design discussion considerably.
In our case, it led to a deliberately conservative boundary: the agent analyzes, flags, and recommends. It does not approve, execute, or take ownership of an outcome, because accountability must remain assigned to identifiable people and organizations; it cannot be delegated to the model. If something goes wrong, "the agent decided" isn't an answer anyone in freight - or honestly, anywhere - is going to accept.
A framing that's helped more than any specific rule
The framing we kept coming back to, especially when a new feature request tempted us to expand scope, was this: don't build a system that's secure because of policy - build one where the risky thing simply isn't possible by design.
A policy says "the agent shouldn't do X." Architecture should make prohibited high-impact actions unreachable by the model, while policy, authorization, monitoring, and data-handling controls address the remaining risks. It's a more boring way to build software. It's also a lot more resilient, because it doesn't depend on every future engineer remembering the rule, or every prompt update preserving the guardrail.
Questions worth asking before you widen an agent's scope
If you're building an AI agent right now, here's roughly the checklist we run through before adding a new capability:
- What does the agent actually need to see? Does this feature require a new data source, or would access simply be more convenient?
- What's the blast radius if it gets this wrong? A bad recommendation, or an external commitment?
- Is this analysis or action? Are we asking the agent to understand something, or to change something?
- If it's an action - is it reversible? The harder it is to undo, the stronger the case for human confirmation.
- What's the minimum permission required? If the feature works without credentials or persistent sessions, don't add them "just in case."
- Do we need this access now, or are we adding it for a possible future use case? If it's the latter, don't add it yet.
The goal isn't to make an agent incapable of doing useful work. It's to make the boundary between what the agent can understand and what it can change explicit - as a product decision, a security decision, and an architectural decision, not something left to a prompt.
None of these questions require exotic tooling to answer. They mostly require being willing to say no to your own feature ideas, which is the actual hard part.
Closing thought
The capabilities will keep expanding. The boundary shouldn't have to move at the same speed.
What an agent can do will keep getting more impressive every quarter. What it should be allowed to do on its own is a much slower-moving, much more durable question - and it's the one that ultimately determines whether people trust the system enough to let it near their real work.
I'm curious how other teams building AI agents are drawing this line internally — especially in domains where a wrong autonomous action has a real, immediate cost. Happy to compare notes in the comments.
Top comments (0)