Letting an AI agent hit 'like' scared me more than letting it post

I entrusted an AI agent to manage the social media for my product. At first, granting permission to post content wasn't too alarming. After all, the words were our own, and we bore the sole responsibility for any potential embarrassment. The next step I desired was the ability for the agent to react to other users' posts, including liking, replying, and following.

This feature, commonly referred to as engagement, piqued my interest. Upon beginning its design, I realized that engaging with others posed a distinct kind of fear compared to simply posting. Posting involved planting our own content, while reacting entailed knocking on others' doors. The consequences of a poorly executed react could directly impact someone else's brand.

Consequently, I decided to separate the posting and reacting functionalities into distinct commands, granting the agent the authority to handle each task independently. I avoided combining these functionalities as I believed it would dilute the stringent control necessary for interactions with other users. To prevent any potential issues, I implemented a two-stage approval process.

The first stage required approval of the plan, specifying which users to engage with and the type of reaction to be used. The second stage focused on approving the execution, mandating approval for each individual action, defined by the target user, action type, and reply text. Bulk approvals were strictly prohibited, ensuring that every action received explicit approval.

Before making any replies, I introduced a crucial verification step to ensure that the target user was appropriate and relevant. This involved excluding various categories of users, such as those related to politics, religion, discrimination, health, minors, sensitive attributes, suspected impersonation, bots, or unrelated content.

Additionally, I required the target user to be clearly related to our own account or multilingual, ensuring a level of relevance before allowing any reactions. To further safeguard against potential mishaps, I required a confirmation of the target's identity before initiating any reactions. This involved carefully examining the target user's handle, display name, pinned tweet, and parent thread, confirming that they were genuine and not an impersonation.

Even a simple "no" response would suffice, as it would still count as a reply. I ensured that the agent only reacted to users who met all the specified criteria, eliminating any risk of accidentally engaging with undesirable users. In addition to these measures, I implemented safeguards to prevent unwanted reactions. For likes and follows, I required "who am I" confirmation and idempotency guarantees, ensuring that the agent could verify its own actions and prevent accidental double executions.

Moreover, I made it mandatory for the agent to leave a marker indicating the intended action before executing it. This marker served as a record of the planned operation, allowing for easy verification and preventing any potential errors. During the design phase, I strictly limited the agent's actions to screen-reading tools, forbidding any clicking or typing.

This restriction aimed to prevent the agent from accidentally triggering reactions or other unintended actions. By adhering to these guidelines, I aimed to create a secure and controlled environment for the AI agent to manage and interact with the social media aspects of my product.