The AI Trust Ladder: how much should you let AI touch your business?
Self-driving cars move through clearly defined levels of automation. Your business should too. Four rungs, from "AI can read" to "AI can act", and the rule I use for climbing from one to the next.
The question I hear most from business owners isn't "What can AI do?" It's a quieter one: "What happens if I give it access and it does something stupid?"
It's the right question. The answer isn't "trust it" or "don't". It's to hand over control in stages, the way the car industry does.
Borrowing from self-driving cars
The Society of Automotive Engineers (SAE) defines six levels of driving automation, from Level 0 (the human does everything) to Level 5 (the car drives itself anywhere). Nobody jumps a new car straight to Level 5. Each level has to earn trust before the next.
Small businesses need the same thing, but simpler. I use four rungs:
Rung 1: Read
AI can look at your data and explain it, such as your inbox, sales numbers or ad account. It can't change anything.
Rung 2: Suggest
AI recommends what to do next: which leads to call, which replies are urgent, which spend to cut. You decide and act.
Rung 3: Draft for approval
AI prepares the actual work, such as the reply, the quote or the campaign change, and waits for you to say yes.
Rung 4: Act within limits
AI does the task by itself, but only inside boundaries you set, and it reports what it did.
The rule for climbing: move up one rung only when the current one has been right, consistently, on real work, for long enough that you've stopped checking out of anxiety and started checking out of habit.
What each rung looks like in my own work
I run most of my own operations with AI, so I've lived on every rung.
Rung 1: Read. My Google Ads account
When I connected Claude to my Google Ads account, it started read-only. That alone was worth the setup: it found that a purchase action had a default-value setting switched on, recording every sale as $1. It was a setting the dashboard made easy to miss. The story is here.
Read access carries almost no risk and often pays for itself on day one.
Rung 2: Suggest. Which enquiries matter
The demos on my Tools page live here. The Inbox Money Filter sorts messages by revenue, urgency and risk, and the Lead Fit Scorer rates a lead against the owner's own criteria. They recommend and you decide. When they're unsure, they say so and escalate.
Rung 3, then Rung 4: 15,000+ replies on X
My agent team for X drafts, checks and queues replies. It started on Rung 3: I approved everything before it went out. Once the drafts had been right for long enough, routine batches climbed to Rung 4. They now post under rules I approved, and anything uncertain still waits for me. It has published more than 15,000 replies that way. Rung 3 lets you get most of the time savings while keeping your name on every decision, and it's how the system earned the next rung. The case study explains the system.
Rung 4: Act within limits. Routing bookings automatically
For the MummyReady funnel, booking routing ran fully automatically. When a parent booked a review, the right advisor got an email with the details within seconds, with no human in between. That was safe because the action was narrow, easy to reverse, and visible: the team lead was copied on every booking.
Rung 4 is right for tasks that are low-risk, reversible and logged. It's wrong for anything involving money, legal commitments or a customer's first impression, at least until the lower rungs have earned it.
What climbing too fast looks like
Even with care, systems misbehave. My posting tool once reported three login failures that weren't real. Because it was designed to stop safely before typing anything, the only cost was three wasted attempts. The fix meant changing production code, so it waited for my explicit approval rather than being patched on the spot.
That's the point of the ladder. When something goes wrong on a well-designed rung, the damage is a delay, not a disaster.
The limits that make Rung 4 safe
When a task does reach Rung 4, I set limits before switching it on:
- Scope: exactly which actions it may take, such as "send booking confirmations" rather than "email customers".
- Size: a ceiling on money, volume or frequency.
- Visibility: every action is logged somewhere a person actually looks.
- An off switch: anyone on the team can pause it without calling me.
The same thinking applies to security. An AI server that anyone on the internet can reach has skipped every rung at once. (My logs showed 165,000 break-in attempts in 90 days before I closed the doors.)