One of the most notable changes with GPT-6 Astra is:
AI no longer just tells you:
what the next step should be.
It can now:
actually do it.
Open websites.
Operate desktop apps.
Click buttons.
Input data.
Edit spreadsheets.
Update CRM.
Run tests.
Even handle:
older systems without APIs.
This is very convenient.
But it also means:
A simple prompt like:
“Help me organize these customer records.”
could now actually cause system changes.
So today, learn just one method:
Before letting Astra operate your computer, first write a:
Three-Box Permission Card.
It only has three boxes:
What is allowed.
When to definitely stop.
What to report after completion.
Box 1: What is Allowed?
Don’t write:
“You may operate the CRM.”
The scope is too broad.
The CRM may include:
customer names, phone numbers, payment info, contracts, delete buttons, emails, permission settings.
“Operate CRM”
does not really tell AI:
what exactly it is allowed to do.
A better approach is:
Allow access to the CRM, search specified customers, and modify phone numbers, emails, and contact status only.
This defines:
the scope.
Separate app access and action permissions
For example:
Being able to open Excel
does NOT mean:
being able to modify all Excel files.
Being able to open CRM
does NOT mean:
being able to change all customer records.
Being able to use a browser
definitely does NOT mean:
being able to visit any website.
So Box 1 should clearly answer three questions:
Where can it go?
What can it see?
What can it modify?
For example:
Can access:
Company CRM
Can view:
30 customers on the provided list
Can modify:
Phone, email, follow-up status
Other fields:
do not touch.
It's much clearer immediately.
Box 2: When must it definitely stop?
This box is even more important.
Because the real danger isn’t:
AI being unable to operate.
It’s that:
when encountering unexpected situations, it keeps guessing and proceeding.
For example, if you assign Astra:
Update customer data.
But it finds:
two customers with the same name.
What should happen?
Don’t let it:
pick the closest match on its own.
Stop instead.
If new data conflicts with CRM data:
Stop.
If suddenly prompted:
“Delete old records?”
Stop.
If the system requires:
re-login.
Stop.
If the task originally only needed CRM access,
but suddenly requires visiting another website,
Stop.
Stop conditions aren’t just “ask me before paying”
Many people, when setting up AI agents,
first think of:
“Always ask before payment.”
That is good.
But Computer Use needs many more stop points, such as:
When deleting any data.
When sending messages externally.
When uploading company data to a new website.
When downloading unknown files.
When encountering insufficient permissions.
When data conflicts arise.
When specified records cannot be found.
When the task requires apps beyond the original scope.
When any action is not listed in the allowed list.
All of these can be predefined as:
Stop.
Why should “Don’t know” also be a stop condition?
Humans often do this:
“This looks like Mr. Wang, right?”
Then call to confirm.
But one of the biggest risks for agents is:
To complete a task,
turn “don’t know”
into guessed answers.
You can just add:
“If proceeding requires guessing without sufficient data, stop and ask me.”
This sentence is very valuable.
Because:
Not knowing
is not failure.
Not knowing but continuing is a failure risk.
Box 3: What must be reported after completion?
Many agent prompts only have:
start instruction.
but no:
end condition.
For example:
“Help me update these 30 customer records.”
AI might say at the end:
Completed.
But you don’t know:
if all 30 were truly updated?
whether any were skipped?
which fields were changed?
whether errors occurred?
whether exceptions were handled independently?
So Box 3 should specify what to deliver after completion:
A change report.
The change report doesn’t have to be complicated
It should at least include four things:
First:
Which items were successfully modified.
Second:
Which items were not modified.
Third:
Which items require human decision.
Fourth:
Any errors or anomalies during execution.
That way,
“Completed”
really means something.
Here’s an example of a full three-box permission card
Suppose your job is to:
Update the confirmed customer list
into an old CRM.
You can give Astra:
Task: Update the company CRM using the confirmed customer list I provide. 【Allowed】 - Only operate the company CRM. - Search only the customers on this list. - Modify phone, email, and contact status only. - Read existing data for comparison. - Do not modify other fields. 【Must Stop】 - Cannot find an exact matching customer. - More than one possibly matching record found. - New data conflicts with existing data without clear source. - Need to delete data. - Need to send emails, messages, or external communication. - Need to upload data outside CRM. - System requires extra login, permissions, or payment. - Needs to use apps or websites not listed in allowed scope. - Any step requires guessing to continue. Stop immediately in any of the above situations. Do not decide independently. 【Report After Completion】 - Which customers were successfully modified. - Which fields were changed for each. - Which customers were skipped and why. - Which items still require my decision. - Any errors or anomalies during execution.
This is the:
Three-Box Permission Card.
Why can’t Astra decide entire risks by itself?
GPT-6 Astra indeed better respects:
task boundaries.
OpenAI says:
Astra behaves more cautiously with sensitive tasks.
ChatGPT Work and Codex still have:
confirmation policy, auto-review, and other safety mechanisms.
But that doesn’t mean:
users don’t need to clearly specify business boundaries.
Because the system doesn’t know:
what your company absolutely cannot touch.
System safety and your work rules are two different layers
For example, OpenAI can tell:
Deleting data probably needs caution.
But it doesn’t know:
Your company’s internal rule that
only supervisors can change customer status to Closed.
If you don’t tell AI this,
it might not know.
Another example:
Your company rule:
Quotes above NT$50,000 always require supervisor approval.
This isn’t a general AI safety rule.
It’s:
Your business rule.
So complete safety requires:
platform protection,
plus:
your own work boundaries.
Enterprise admins can even directly restrict websites and apps
OpenAI currently offers enterprise controls to restrict:
browser use, computer use,
which websites can be accessed,
which desktop apps can be operated.
Also restrict:
uploads, downloads, approvals.
This is the technical layer.
For example, IT departments can set:
CRM: allowed
Company knowledge base: allowed
Banking site: not allowed
Payroll: not allowed
But individual tasks still need their own small scope
Just because the company allows Astra to operate CRM,
doesn’t mean it should have access to all CRM functions for every task.
If today the task is to just update phone numbers,
then only allow it to update phone numbers.
This concept is called:
Least Privilege.
Don’t ask:
What can AI do at most?
Ask instead:
What is the minimum needed to complete the task?
A simple test
Before granting each permission, ask:
If I don’t give this permission, can the task still be completed?
If yes,
don’t grant it.
For example:
Just updating customer phone numbers
needs CRM.
No need for:
Gmail, banking account, production server, personal drive.
“Browser allowed” is a very big permission
Many people think:
“It’s just to let AI open a browser, what’s the harm?”
But browsers may have:
logged-in accounts, cookies, company SaaS, cloud admin, social accounts, payment platforms, internal systems.
So enterprises use:
allow lists to only open specified websites,
not the entire Internet.
For a first run of Computer Use, narrow permissions further
If the process is new and never run before,
don’t even let AI make changes at first.
Start with:
Inventory only.
For example:
“First find these 30 customers’ CRM records, list fields you plan to modify, but don’t modify yet.”
Confirm once.
Execute changes in a second round.
This aligns with previous principles of:
inventory first, no modifications.
Today’s three-box card:
makes scope clearer before actual execution.
Be more cautious when operating Production
Computer Use can give a false impression that AI is like:
a real employee.
So one might think:
“Since it can use it, let it handle it.”
But real employees have:
training, roles, access control, approval, audit logs.
A new hire doesn’t get Production admin rights on day one.
AI shouldn’t either.
If possible, work in:
Staging, copies, or drafts first.
Don’t go straight to Production.
AI operating legacy systems needs clearer verification
Legacy systems often have issues like:
ugly UIs, awkward button placement, unclear error messages.
After operations, success messages may be missing.
AI agents might:
think the task is completed
when changes weren’t saved.
So don’t just require “tell me it’s done.”
Ask for:
“After finishing, reopen modification logs to confirm values saved correctly.”
Don’t just trust:
the action.
Check the:
result.
The same applies to spreadsheets
If you ask Astra to tidy up an Excel file,
Allowed:
Modify specified sheets.
Create formulas.
Adjust formatting.
Must stop:
If source data is missing.
If formulas overwrite manual entries.
If numbers conflict with source data.
If entire rows must be deleted.
Report after completion:
Which formulas were added.
Which fields were modified.
Any abnormal numbers found.
Again, three boxes.
The same method can apply to website QA
Task:
Test staging website.
Allowed to:
Open staging environment.
Create test accounts.
Complete registration flows.
Take screenshots.
Must stop:
Encountering production environment.
Requiring real payments.
Using actual customer data.
Deleting data.
Report:
Successful flows.
Failed flows.
Screenshots.
Steps to reproduce.
Computer Use thus moves from:
“Try testing on your own”
to:
a QA task with clear acceptance criteria.
Also applicable to calendars
Task:
Find meeting times for three people.
Allowed to:
Read calendars of the three.
Find two common time slots.
Must stop:
If needing to cancel existing meetings.
If moving others’ meetings.
If sending invitations directly.
After completion:
List the two candidate times.
Don’t send invitations.
You’ll realize:
Agent safety doesn’t require:
raising legal documents for every task.
It just needs:
a clear boundary.
“Allowed to do” is best written as a whitelist, not a blacklist
For example:
Don’t write:
“Don’t delete data.”
Because AI might do many other actions.
Better to write:
Only allowed to modify phone and email.
Anything not phone or email
is automatically out of scope.
This is called:
allow lists,
which is easier to control than listing:
can’t do A,
can’t do B,
can’t do C.
“Must stop” fits exceptions that really matter
Whitelist tells AI:
the normal work scope.
Stop conditions tell it:
if uncertain,
don’t expand scope on your own.
Together,
they work best.
The normal route:
go ahead.
Off normal route:
stop.
“Report after completion” is actually the first step of auditing
Enterprises will want to know eventually:
What did the agent do?
When did it do it?
What changed?
What wasn’t done?
If every agent task ends with a simple change report,
issues in the future
are easier to trace.
So the third box isn’t:
just a nice summary,
but a
record of responsibility.
Astra already has stronger safeguards, but OpenAI still keeps manual confirmation
This point explains the issue well.
OpenAI describes Astra as:
better at respecting task boundaries.
Unintended results from Computer Use
are much reduced compared to earlier models.
But ChatGPT Work and Codex
still retain:
confirmation, auto-review, monitoring.
If “smarter models” alone solved safety,
these systems wouldn’t exist.
They exist because:
smarter judgment doesn’t mean removing all responsibility.
If Astra stops itself, don’t see it as a failure
For example, if it suddenly says:
This step requires your confirmation.
Many will think:
“Why is this so troublesome?”
But for an agent that really operates computers,
being able to stop
is a capability.
Especially when it involves:
permission changes,
data conflicts,
external transfers,
and irreversible actions.
Slowing down for 10 seconds is usually cheaper
than fixing errors all day.
Today, what really needs changing is prompt thinking
Previously, when using ChatGPT,
The most important prompt question was:
What answer do I want?
After Computer Use,
three more questions are needed:
What can you do?
When must you stop?
What evidence do I want after completion?
These three questions
are much more effective than:
“Please be more careful.”
So remember just these three boxes today
Next time you prepare to let:
Astra,
ChatGPT Work,
Codex,
or another Computer Use agent
actually operate your software,
don’t just say:
“Handle everything for me.”
First write:
Allowed
Which apps, data, and actions are truly needed.
Must Stop
All uncertainty, boundary breaches, irreversible or high-risk conditions.
Report After Completion
What was changed, what wasn’t, errors encountered, and what still needs human decisions.
When AI truly starts operating computers,
a good prompt
is not just:
a work instruction.
It’s also:
a permission guideline.
A mature agent workflow
doesn’t let AI:
touch everything.
It lets AI have
just the right permissions to complete the task.
Today, grow a little with AI.
Learn one AI skill a day.
Save some time every day.
Improve a bit more each day.
SasaDaily, growing with you.
