The Day My AI Agent Refused to Touch Production
Two in the afternoon, I told my AI assistant to build a CI/CD pipeline for one of my products: tests must pass before anything reaches production, no more manual deploys by hand. Simple ask. I gave it a green light in advance so it would not have to stop and ask for every step. An hour later it stopped anyway, in the one place I did not expect.
The pipeline itself went exactly as planned. It wrote the workflow, opened a real pull request, watched the checks run, and the suite went green: eight hundred and sixty-two tests, clean build, clean typecheck. Then, because a gate you have never seen fail is a gate you cannot trust, it deliberately broke a test on a throwaway branch, pushed that too, and watched the same check turn red. Confirmed the pipeline blocks a bad build. Closed that branch without merging it. That part is exactly what I would have asked a senior engineer to do, unprompted.
Then it hit the wall I built for it
The next step was the deploy workflow: the file that, once approved, would SSH into the production box and restart the service. My assistant wrote the YAML and tried to save it. The save was refused. Not by me, not by a slow human review queue, by the tool's own safety layer, tagged plainly as a production-touching action. It tried once more after I confirmed out loud that it had permission. Refused again, same reason.
That is not the AI checking its own judgment. That is a rule sitting underneath the AI, one that a mid-conversation "go ahead" cannot unlock. To actually let the write through, I would have to change a setting on my own machine, deliberately, outside the chat. The assistant told me exactly that, and then stopped trying.
I did not build that particular wall on purpose. I had written a much softer version of it: a line in my operating instructions saying any production action needs my explicit approval, asked again right before it runs. What surprised me was finding out the platform enforces something like it at a level below my own rules, one my own "yes, go" in the middle of a conversation does not override.
Why a PM should care about this, not just an engineer
I have spent sixteen years watching production incidents start the same way: someone had verbal approval, everyone remembered a different version of what was approved, and the actual command that ran was not the one anyone pictured. The fix the industry settled on was never "ask people to remember better." It was moving the approval into the pipeline itself, a required reviewer on the environment, a gate that does not care how confident anyone sounded five minutes ago.
Watching an AI agent hit that same kind of gate, unprompted, on infrastructure I had not even finished designing yet, told me something worth writing down: the safest AI workflows will not be the ones with the best prompts. They will be the ones where the platform makes "verbal approval does not count for production" a fact about the system, not a hope about the AI's manners.
Three things I am changing because of one afternoon
- Write the approval gate into the plan before the AI ever touches the keyboard, the same way I would write it into a runbook for a new hire, so what gets enforced by the tool and what I still have to catch myself never has a gap between them.
- Treat a refusal as a signal, not a bug. My first instinct was to find a way around it. The better instinct, the one I want to keep, was to stop and ask which of us should be doing this step, out loud, before trying again.
- Keep production access request-scoped, not session-scoped. Approving a plan is not approving every action inside it. That was already my rule for people. Now it is my rule for AI too, and I have watched it get enforced from the other side of the conversation for once, not just my side.
The pipeline itself is close to done: the test gate is live and proven, the deploy half is written and waiting on me, sitting exactly where a real reviewer should sit. See also Managing AI Like a Team, Not a Tool: the same lesson keeps showing up under different names. Treat the AI like a team member with real boundaries, and it starts protecting you from mistakes you have not made yet.
Nguyễn Hải Nam
Nguyễn Hải Nam
Project Management Lead. 16+ years from code to delivery. PMP®. Writing here about project management and engineering.