The only safe way to let AI touch your processes

There is exactly one safe way to let AI change your processes: sort every proposed change by whether it can alter what the process produces. Changes that provably can’t are safe to apply automatically. Everything else waits for a test and a human yes, and every version of everything gets saved so you can undo any of it with one click.

That’s the whole system. The rest of this post is those three sentences slowed down.

Sort changes by what they could break

In Tallyfy, a step is a small set of written instructions. Sometimes a person reads and follows them, sometimes an AI does, but either way the step is the unit of work, which makes it the unit of improvement too. When Stern Stella proposes a change to a step, the first question we make it answer is what the change could touch.

Three answers are possible for AI-run steps. The change can’t touch the output at all. The change might, because it edits what the AI reads. Or the change is structural, big enough that no test could fully vouch for it. Each answer gets a different treatment, and the treatments never blur.

Human-run steps get a fourth, stricter answer of their own. We’ll get to it.

Which changes are safe to apply on their own?

Just the first kind: changes where the AI sees exactly the same instructions and produces its answer the same way, while the thing that moves is what we pay or when the work runs. We pay less for the exact same work. There’s no judgment call hiding inside that sentence, which is what makes it safe to automate.

Two plain examples. A step that reads invoices every night doesn’t need an instant answer, and AI providers sell the identical request at half price when the work can wait a little, so that step moves to the overnight queue. Same instructions, same result, half the bill. And when a step’s fixed instructions repeat across runs, providers bill the repeated part at a fraction of the price; Anthropic’s own documentation says the response you receive is identical either way.

Identical as in character-for-character, not identical as in close enough.

Every one of these auto-applied savings still shows up inside the process itself, as a completed task with a comment: what changed and what it saves. Silent would be cheaper. Silent is how trust dies.

Everything else asks first

The second kind of change edits what the AI reads. Rewording instructions, say, or merging two steps that always run together. These can change behavior, so they’re treated as guilty until proven safe: the proposed version gets tested against the step’s own history, checking that it still does what last month’s runs did, and then a human reviews the evidence and approves or rejects it inside the workflow, as a normal approval task. No side channel, no surprise.

The third kind is structural, like reordering the process or splitting a role in half. Stella will suggest these when the evidence points that way, with the reasoning attached, and will not apply them. Advice only. A recommendation you can take to the team or ignore.

Could the system move faster by skipping the approvals? Sure. So could a driver skipping red lights, and the trip works right up until it doesn’t.

Human steps follow a stricter rule

The biggest lesson we’ve learned building Tallyfy: people forgive slow, but they don’t forgive silent. So for steps a person reads, there are no tiers at all. Text a human follows is never changed without approval, including the cases where we feel sure.

What the AI contributes on human steps is the draft plus the evidence behind it. If a step keeps getting sent back, or keeps collecting the same clarifying question, or takes three times its target time, that pattern is visible in the runs, and it becomes a proposed rewrite with the pattern attached. The owner reads the before and after alongside the reason, then decides. Approval here does real work: it keeps rewrites tied to run evidence instead of taste.

You can always go back

A question we hear in almost every conversation about AI features: what happens the day a change slips through and nobody notices? A fair worry. Guarantees convince nobody without an exit.

So nothing is ever thrown away. Every version of every step is kept forever, the way source code is kept. Wait, plainer: like a filing cabinet where nothing gets shredded and every folder names the folder it replaced. Rolling back is one click, and the rollback itself gets logged, so even your undo has a history. If a rewrite approved on Tuesday reads wrong on Friday, Friday-you wins the argument.

That version trail also settles a quieter fear, the one about losing track of your own processes once AI is involved. The opposite happens on purpose. You end up with more history and better receipts than the manual way ever produced.

The DIY version of this, where a clever script rewrites prompts in place, has none of these guardrails, and we’ve written about how that goes.

Safe has a checkable definition here. Either a change can alter what your process produces, or it provably cannot, and everything about how the change is handled follows from that one answer. A tool that can’t answer the question might still be lucky. Luck is a rubbish control.