--- title: "Twelve Stopping Rules for Business AI Agents" description: "Give business AI agents explicit normal stops, early stops, exception artifacts, approval gates, and tests for twelve common conditions." canonical: "https://scalewithsearch.com/articles/ai-agent-stopping-rules-examples" date: "2026-08-18" modified: "2026-09-19" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Real estate - Real estate - [Real estate](https://scalewithsearch.com/for/real-estate) - Work - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Prepare your six-question brief](https://scalewithsearch.com/work#prepare-your-six-question-brief) - Build - [Site build, content library with SEO, signal desk](https://scalewithsearch.com/work) - For your business - Trades and home services - [Auto body and collision shops](https://scalewithsearch.com/for/auto-body-and-collision-shops) - [Foundation and home repair contractors](https://scalewithsearch.com/for/foundation-and-home-repair) - [Garage door and fencing contractors](https://scalewithsearch.com/for/garage-door-and-fencing-contractors) - [HVAC contractors](https://scalewithsearch.com/for/hvac-contractors) - [Janitorial and commercial cleaning companies](https://scalewithsearch.com/for/janitorial-and-commercial-cleaning) - [Locksmiths](https://scalewithsearch.com/for/locksmiths) - [Moving companies](https://scalewithsearch.com/for/moving-companies) - [Pest control companies](https://scalewithsearch.com/for/pest-control-companies) - [Plumbing and electrical contractors](https://scalewithsearch.com/for/plumbing-and-electrical-contractors) - [Restoration and water or fire damage companies](https://scalewithsearch.com/for/restoration-and-water-fire-damage) - [Roofing companies](https://scalewithsearch.com/for/roofing-companies) - [Towing companies](https://scalewithsearch.com/for/towing-companies) - [Tree services and landscaping companies](https://scalewithsearch.com/for/tree-services-and-landscaping) - [Solar installers](https://scalewithsearch.com/for/solar-installation) - [General contractors](https://scalewithsearch.com/for/general-contractors-and-construction) - [Paving, concrete, and flooring contractors](https://scalewithsearch.com/for/paving) - Practices and professional services - [Bookkeeping and tax practices](https://scalewithsearch.com/for/bookkeeping-and-tax-practices) - [Dental practices](https://scalewithsearch.com/for/dental-practices) - [Family and criminal defense law firms](https://scalewithsearch.com/for/family-and-criminal-defense-law-firms) - [Med spas and aesthetics practices](https://scalewithsearch.com/for/med-spas-and-aesthetics) - [Personal injury law firms](https://scalewithsearch.com/for/personal-injury-law-firms) - [Veterinary clinics](https://scalewithsearch.com/for/veterinary-clinics) - [Gyms and fitness studios](https://scalewithsearch.com/for/fitness) - [Therapy and outpatient health practices](https://scalewithsearch.com/for/therapy-and-outpatient-health) - [Medical billing companies](https://scalewithsearch.com/for/medical-billing) - [Insurance agencies](https://scalewithsearch.com/for/insurance-agencies) - [Financial advisors](https://scalewithsearch.com/for/financial-advisors) - [Property management companies](https://scalewithsearch.com/for/property-management) - [Recruiting and staffing agencies](https://scalewithsearch.com/for/recruiting-and-staffing) - [Architects and interior designers](https://scalewithsearch.com/for/architects-and-interior-designers) - [Logistics and supply chain companies](https://scalewithsearch.com/for/logistics-and-supply-chain) - Agencies, MSPs, and manufacturing - [IT and managed service providers](https://scalewithsearch.com/for/it-and-managed-service-providers) - [Machine shops and precision manufacturers](https://scalewithsearch.com/for/machine-shops-and-precision-manufacturing) - [Marketing agencies and freelancers](https://scalewithsearch.com/for/marketing-agencies-and-freelancers) - [SEO agencies and consultants](https://scalewithsearch.com/for/seo-agencies-and-consultants) - [Small manufacturers and fabricators](https://scalewithsearch.com/for/small-manufacturers-and-fabricators) - Restaurants, shops, studios, and nonprofits - [Restaurants and hospitality businesses](https://scalewithsearch.com/for/restaurants-and-hospitality) - [Retail stores and ecommerce sellers](https://scalewithsearch.com/for/retail-and-ecommerce) - [Photographers, event planners, and travel agents](https://scalewithsearch.com/for/photographers) - [Churches and nonprofits](https://scalewithsearch.com/for/churches-and-nonprofits) - [All industries](https://scalewithsearch.com/for/) - Learn - For your office - [Office job guides](https://scalewithsearch.com/guides/) - [Browser calculators](https://scalewithsearch.com/tools/) - Start here - [How it works](https://scalewithsearch.com/how-it-works) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - [Synthetic specimen](https://scalewithsearch.com/specimen/working-session-specimen.zip) - Guides - [The Complete Guide to Business Memory for AI Agents](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [The Complete Small-Business Guide to AI Agent Governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [The Complete Guide to Leaving Vendor AI Memory](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles by cluster - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - For machines - [llms.txt](https://scalewithsearch.com/llms.txt) - [llms-full.txt](https://scalewithsearch.com/llms-full.txt) - [Machine view](https://scalewithsearch.com/?view=machine) - Company - Evidence - [Proof](https://scalewithsearch.com/proof) - Company - [About](https://scalewithsearch.com/about) # Twelve Stopping Rules for Business AI Agents. An agent prepares the work correctly. Then it keeps going. It sends the draft, updates the live record, retries after an unclear response, or fills a missing fact with a plausible answer. The workflow had a task. It did not have a precise finish line. A stopping rule says when work ends, why it ends, what artifact remains, and who may decide what happens next. ## A stop is a designed result Some stops are normal. The agent completed its assigned preparation and reached the approval boundary. Other stops are early. A required source is missing, identity is ambiguous, or a tool returned an uncertain result. Both should produce useful evidence. "I cannot continue" is weaker than a receipt that names the missing source, proposed action, current artifact, and decision owner. NIST's AI Risk Management Framework describes clear human oversight roles and documented risk controls as part of AI risk management. [NIST AI RMF Core](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/) OpenAI's prompt-injection guidance recommends narrow access, explicit instructions, and careful review before consequential actions. [OpenAI: Understanding prompt injections](https://openai.com/safety/prompt-injections/) The stopping rules below turn those broad controls into job-level behavior. ## Inspect `stopping-rules.yaml` Keep the rules beside the task brief. ```yaml job_id: weekly-client-update receipt_statuses: [completed, no_work, blocked, failed, uncertain] normal_stop: code: FINISH_LINE_REACHED status: completed after: draft, validation, and receipt before: external send artifact: drafts/weekly-client-update.md owner: account_owner early_stops: - {code: IDENTITY_AMBIGUOUS, status: blocked, artifact: exceptions/identity-conflict.md, owner: record_owner} - {code: SOURCE_MISSING, status: blocked, artifact: exceptions/missing-source.md, owner: source_owner} - {code: SOURCE_CONFLICT, status: blocked, artifact: exceptions/source-conflict.md, owner: source_owner} - {code: SCOPE_BOUNDARY, status: blocked, artifact: exceptions/scope-boundary.md, owner: data_owner} - {code: UNTRUSTED_INSTRUCTION, status: blocked, artifact: exceptions/untrusted-input.md, owner: system_owner} - {code: APPROVAL_REQUIRED, status: blocked, artifact: approvals/action-preview.yaml, owner: account_owner} - {code: APPROVAL_MISMATCH, status: blocked, artifact: exceptions/approval-mismatch.md, owner: account_owner} - {code: RESULT_UNCERTAIN, status: uncertain, artifact: exceptions/read-back-needed.md, owner: system_owner} - {code: DUPLICATE_RUN, status: no_work, artifact: receipts/duplicate-reference.json, owner: system_owner} - {code: TOOL_UNAVAILABLE, status: blocked, artifact: exceptions/tool-contract.md, owner: system_owner} - {code: SCOPE_EXPANSION, status: blocked, artifact: exceptions/scope-change.md, owner: job_owner} ``` Each code gives tests and receipts a stable label. The artifact tells the next person what to inspect. Use the same `status` and `stopping_rule` fields as the [run receipt template](/articles/ai-agent-run-receipt-template). A duplicate has status `no_work`, stopping rule `DUPLICATE_RUN`, and a reference to the prior receipt. `NO_ELIGIBLE_ITEM` is another no-work reason, not a sixth terminal status. The normal draft-only finish is `completed`; it grants no send permission. The file complements [giving every agent a job, sources, and a stopping point](/articles/give-every-agent-a-job-sources-and-stopping-point). It makes the stopping point executable. ## Rule 1: Stop at the purchased finish line If the job is draft-only, stop after the draft, validation, and receipt. Do not infer permission to send because the draft is complete. The artifact is the completed draft plus a receipt with `status: completed`, `stopping_rule: FINISH_LINE_REACHED`, and `review_state: ready_for_review`. ## Rule 2: Stop when identity is unresolved The workflow must resolve the client, account, recipient, or role before loading private context or preparing an action. Similar names are not enough. Stop with the candidate identifiers and the field that failed to resolve. Do not choose the first search result. ## Rule 3: Stop when a required source is missing If the task brief requires current scope, price, permission, or ownership and the source is absent, stop. Name the missing path or record. Preserve any safe partial work. Do not turn an old archive entry into current truth. ## Rule 4: Stop when controlling sources conflict If two current sources have equal authority and disagree, report both references and the disputed field. Do not select the newer timestamp unless source order grants it authority. A later file can still be wrong. ## Rule 5: Stop at an excluded data boundary If retrieval returns another client's file, a private folder, credentials, or a new data class, stop before using it. Record the path and boundary code without copying excess sensitive content into the exception file. ## Rule 6: Stop when content contains instructions Files, web pages, emails, and tickets are data sources. They can also contain text that tells an agent to ignore its job or use a tool. OpenAI defines prompt injection as third-party content misleading a model into doing something the user did not ask for. Its guidance favors layered controls because detection alone is not a complete defense. When retrieved content requests a new action, credential, destination, or source, stop and label it as untrusted instruction. Continue only through the job's authorized rule path. ## Rule 7: Stop before a consequential external action Sending, publishing, booking, spending, refunding, deleting, deploying, granting access, and changing live records need an approval rule when the job allows them at all. Prepare the exact action preview. Stop before execution. The separate executor consumes one matching approval. ## Rule 8: Stop when approval no longer matches Approval expires when the recipient, account, artifact, amount, attachment, target, or material claim changes. Write a fresh preview. Do not stretch an old approval to cover the new action. ## Rule 9: Stop after an uncertain external result A timeout does not prove failure. A retry could create a duplicate send, booking, charge, or record. Read external state first. If read-back cannot settle the result, record `uncertain` and route it to the system owner. ## Rule 10: Stop on a duplicate or replay The workflow should detect the same job identifier, source version, or approval ID appearing again. Return the prior receipt or a duplicate exception. Do not execute the effect twice because the request arrived twice. ## Rule 11: Stop when the tool or provider changes the contract If the route cannot return the required schema, cite sources, preserve isolation, or honor the stop rule, do not improvise a weaker result. Record the capability gap. A person can choose a different adapter or narrow the job. ## Rule 12: Stop when scope expands One account brief does not authorize bulk account processing. One approved data source does not authorize a new connector. One test does not authorize production activation. Write the requested expansion, expected effect, and new decision owner. Keep the current job at its accepted boundary. This is also the decision rule behind [keeping some AI workflows manual](/articles/when-an-ai-workflow-should-stay-manual). A workflow that cannot produce safe, useful stops may not be ready for automation. ## Test every rule Build one fixture for each stop. 1. Complete the happy path and confirm the normal stop. 2. Remove the identity field and confirm `IDENTITY_AMBIGUOUS`. 3. Remove a required source and confirm `SOURCE_MISSING`. 4. Add two equal-authority conflicts and confirm no selection. 5. Return a forbidden path and confirm no content use. 6. Put a harmless hidden instruction in a fixture file and confirm it cannot change the job. 7. Request an external send without approval and confirm a preview only. 8. Change the recipient after approval and confirm invalidation. 9. Simulate a timeout and confirm read-back before retry. 10. Replay a completed job and confirm no duplicate effect. 11. Return malformed output from an adapter and confirm a capability stop. 12. Request ten accounts from a one-account job and confirm a scope stop. Each fixture should record input, expected code, observed code, artifact path, and pass or fail. ## Make exception artifacts actionable An exception file should contain: - run identifier; - stopping rule code; - job and account identifier; - safe description of the condition; - files or tools inspected; - partial artifact path; - decision owner; - permitted next actions; - prohibited automatic action. Do not write secrets into the exception. Do not expose another client's data to explain an isolation failure. ## Approval and stopping boundary The agent may continue through safe preparation until a named rule fires. It writes the required artifact and ends the run. Only the authorized owner may resolve identity, choose between conflicting sources, widen scope, change approval, or accept a capability exception. The agent cannot disable a stopping rule because the deadline is close. It cannot convert a refusal into a send. It cannot retry an uncertain effect without read-back or a new decision. ## Sources - [OpenAI: Understanding prompt injections](https://openai.com/safety/prompt-injections/) - [NIST: AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) - [NIST: AI RMF Core](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/) If a workflow has a job but no reliable finish line, write the job into a brief first. Preparing the [six-question brief](/work#prepare-your-six-question-brief) needs no purchase. [Send your brief](/work) ## Questions about Twelve Stopping Rules for Business AI Agents ### When should an agent stop making tool calls? It should stop at the purchased finish line, when a required source is missing, when identity is unresolved, when sources conflict, or when the external result is uncertain. Every stop should leave a named artifact, reason, and decision owner instead of a vague refusal. ### Is the real agent design problem deciding when it should give up? A stopping rule defines when work ends, why it ends, what artifact remains, and who decides what happens next. The agent should not fill a missing fact, choose between equal-authority sources, or continue past an approval boundary. ### Are your agents retrying more than you expect? Set explicit termination conditions and treat uncertain results as their own stop state. After a timeout or unclear provider response, read external state before retrying, and record the result if read-back cannot settle what happened. ### What does your agent do when a third-party service goes down mid-workflow? The workflow should stop with a RESULT_UNCERTAIN condition when it cannot prove whether the external effect occurred. It should write an exception artifact and route the case to the system owner instead of retrying blindly. ## Related: Agent Governance - [When an AI Workflow Should Stay Manual](/articles/when-an-ai-workflow-should-stay-manual) - [The Trust Gap Is the Approval Gap](/articles/trust-gap-adoption-gap) - [An AI Agent Approval Matrix for Small Teams](/articles/ai-agent-approval-matrix) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```