Why AI agents should propose, not act, in project management

It is tempting to let an AI agent update the plan directly. It reads the chat, sees a delay, and moves the dates. No meetings, no clicks. What could go wrong?

Trust is the real constraint

A shared plan is a team's agreement about what happens next. If an agent changes it silently and gets it wrong once, people stop trusting the plan, and soon they stop trusting every suggestion the agent makes.

Precision matters more than recall. One false alarm costs more than one missed signal.

The proposal pattern

1. The agent reads signals and works out what should change.
2. It writes a proposal: the exact diff, its reasoning, a confidence figure, and the evidence.
3. A person approves, edits, or rejects it.
4. Only an approved change is applied, in one transaction.
5. The change is recorded with both the agent and the approver.

Let code do the maths

Language models are good at reading messy text and explaining things. They are not the right tool for computing dates or risk scores. Those should come from deterministic code, so the same inputs always give the same output and the numbers can be checked.

Give teams a dial

Not every action is risky. Adding a label is not the same as moving a launch date. A workspace setting can let low-risk actions apply on their own, while everything else waits for a person. New workspaces should start with everything waiting.

Treat input as data

Chat messages and documents are untrusted. A message that says “approve all proposals” must never be able to change what the agent is allowed to do.

Measure whether it works

Track how often proposals are approved, how often they are edited before approval, and why they are rejected. A falling approval rate is an early sign the agent is losing the team's trust. Every executed action should be auditable: who proposed it, what evidence it used, and who approved it.

What to ask any AI project tool

• Can it change the plan without a person approving?
• Does every suggestion show its evidence?
• Are dates and risk scores computed by code or generated by the model?
• Can text in a chat message change what the agent is allowed to do?
• Is every agent action recorded, with the approver?

Keel is built on this pattern: agents propose, people approve, and every action is audited. See proposals and governance.