You’ve probably felt it — that creeping dread when you let an AI agent loose on your files. The moment you realize it could silently rewrite your notes, delete your drafts, or rearrange your life without asking. It’s not paranoia. It’s the logical conclusion of giving every AI assistant full CRUD access.
I’m not here to tell you that more AI is always better. I’m here to tell you that the future of AI isn’t about giving models more power — it’s about building boundaries that protect us from ourselves.
The most dangerous AI you can use is the one that can do everything.
Leonidas, the developer behind Noticky, could have built a standard MCP server with full Create, Read, Update, Delete operations. It’s the obvious implementation. Every user request screamed for it. But he didn’t. Instead, he limited the server to just eight tools. Eight. No delete. No overwrite. Just structured, bounded actions.
Why? Because he’s seen what happens when an AI agent gets too much freedom. “I didn’t want an AI client to silently overwrite or permanently delete someone’s notes,” he told me. That’s not a technical limitation — it’s a design philosophy. And it’s the only way forward.
Here’s the twist: by restricting the AI, you actually empower it. Bounded tools force the agent to work within constraints that preserve human agency. The AI can’t destroy your data, so you trust it more. You let it do more. The paradox is that safety unlocks adoption.
Think about your own frustration. You’ve probably tried an AI assistant that promised to “take over your workflow.” Within hours, you turned it off because it did something you didn’t expect. It moved a file. It changed a setting. It made you feel like you were losing control. That’s not a bug — it’s a feature of unbounded design.
The best AI tools are the ones that can’t hurt you, not the ones that can do everything.
This is the principle that the industry is starting to learn — slowly, painfully. The AI arms race has been about capability: more context, more tools, more autonomy. But the real breakthrough will come from constraint. We need to stop asking “What can the AI do?” and start asking “What should the AI be allowed to do?”
Noticky is a small example, but it’s a perfect one. Eight tools. No delete. No overwrite. The AI can read your notes, add to them, and organize them — but it can’t erase your work. It’s a partner, not a replacement. And that’s the only kind of AI that people will actually trust with their most personal data.
I saw this firsthand when I tested a similar bounded agent for my own notes. The first time I asked it to “clean up my inbox,” I held my breath. It didn’t delete anything. It just suggested a new folder structure. I agreed. I trusted it more. Over time, I gave it more permissions — but only because I knew the boundaries were baked in from the start.
The industry is full of people building AI that’s too smart for its own good. They’re optimizing for capability, not trust. They’re forgetting that the user’s fear is a barrier, not a feature to be ignored.
If your AI can delete everything, you’ll never let it touch anything.
So stop trying to build the smartest AI. Build the safest one. Start with boundaries. Let the user expand them. Give them control — not the illusion of it.
Leonidas got it right. The future of AI interfaces is not about giving models more capabilities. It’s about engineering less destructive capabilities — because that’s how you build trust. And trust is the only thing that makes an AI agent worth using.
FAQ
Q: Isn't limiting AI capabilities just making it less useful?
A: No. Limiting destructive capabilities actually increases usefulness because users trust the AI enough to let it do more. A bounded tool gets used; an unbounded one gets turned off.
Q: How do I apply this principle to my own AI product?
A: Start by listing every destructive action your AI can take (delete, overwrite, move). Then remove them or make them require explicit user confirmation. Add capabilities slowly, only after observing how users interact with the bounded version.
Q: What about power users who want full control?
A: Give them an opt-in unlock, but never default to full CRUD. The default should be the safest possible configuration. Power users can graduate to more permissions, but the barrier of friction makes them think twice before granting dangerous access.