Akbota, the café's editor, approved an ad saying "Pickup until 11:00". The assistant changed the text to "Delivery until 12:00" and sent it for publication with her earlier approval still attached. Both the fulfilment method and the time changed, while the approval belonged to a different text. The error happened in the step from draft to action.
Before you connect an assistant like this, describe its job: which sources it reads, what it prepares and which operations it may perform. All conditions and amounts in this lesson are illustrative. Your task is to tie facts, the text version and tool permissions together so the client gets exactly the work they approved.
Approval belongs to a text version
Version 1
“Pickup until 11:00”
The editor approved this text
Version 2
“Delivery until 12:00”
Return the new terms to the editor
The old approval stays with the old text. Only the version a person reviewed goes to publication.
Choose an outcome before the technology
A GPT in ChatGPT is a configured assistant with instructions, reference material and selected capabilities. Who can create and publish one depends on the account and workspace permissions, and OpenAI describes the conditions for creating GPTs. Setting up an assistant inside ChatGPT and embedding a chat in your own website through the API are two different jobs.
OpenAI is winding GPTs down: it plans to retire them in affected Enterprise workspaces on 11 December 2026, expects other plans to follow the same timeline and recommends moving workflows to Plugins. Personal Free, Go, Plus and Pro accounts can no longer create new GPTs (OpenAI help, as of 15.10.2026). Everything below about sources, permissions and versions applies to any assistant: a GPT, a plugin or an agent built on the API.
In this lesson, an agent is a system that chooses its own steps and uses tools to complete a task. Fixed-sequence automation follows an order set in advance. Both can work with external services. A client cares more about the list of actions the system can take than about what to call it.
For a first launch, pick a process with a clear end. For example, a weekly review of competitors' public offers: selected website pages, a comparison with the previous snapshot and an internal draft with links. The completion criterion: every source processed, unavailable ones flagged, every conclusion backed by material. A handful of websites does not entitle anyone to say the whole market was studied.
For this job the assistant needs to read the selected pages and write to one working folder. The customer database, sending emails and the ad budget have nothing to do with the review. Switch those operations off straight away, before the text is judged.
Prepare reference material with an owner
Product terms, a brand guide and old ads answer different questions. The brand guide suggests a tone, but you will not find today's price in it. An old ad shows how things were said before, while the current offer comes from an up-to-date document. Every factual document needs a version, the date it takes effect and a person responsible for it.
When sources disagree, the assistant shows both and passes the question to the owner of the fact. One document says pickup, another says delivery: the model does not pick whichever promise sounds better. It flags the discrepancy and does the part of the work that does not depend on it.
Include similar product names, withdrawn offers and questions the material cannot answer in your tests. The assistant should be able to say what information is missing and point to what it reviewed. If it fills in a number with no source, the editor will not notice the gap, and the number may end up in an ad.
In the competitor review, keep the address and date for every observation. Mark a page that failed to open as unread: access may simply have failed. Record what you could see and leave the check open while the cause is unknown.
Back restrictions with tool permissions
The instruction "drafts only" must match what the tool can technically do. If the connection can only save a file to the working folder, a mistake in the text will not become a public ad within the minute. That is the mode you want for the first ad materials: a draft, a human review and a separate approval to publish.
| Action | Rule in our process | Record retained |
|---|---|---|
| Read a public source | Selected list only | Address, date and reading result |
| Save an internal review | Working folder only | Version, sources and open questions |
| Publish material in an expanded process | Final text and destination approved | Who approved and what was sent |
| Change an advertising budget | Outside the task | Refusal and reason |
Reading permitted in advance runs within its limits, and the assistant does not ask for permission at every step. For operations with consequences, the system checks the permission against the action's parameters. A general "user confirmed" flag is not enough if the text or recipient changed after it.
In our example, pickup until 11:00 is version 1 and delivery until 12:00 is version 2. The new conditions go back to Akbota, and her approval stays tied to version 1. Publication receives exactly the version the person saw during review.
Resolve a lost response without sending again
Sometimes a service completes an operation but the response never reaches the assistant because of a connection fault. If the assistant decides nothing happened and repeats the request, you get a duplicate: a second email in a mailing, or another record instead of continuing the first.
The integration should store an operation identifier and look up the operation's state. If the service accepts an idempotency key, a retry with the same key will not create a second email. Whether it does is in the service's documentation.
The log distinguishes four states: prepared, request sent, execution confirmed, outcome unknown. If the outcome is unknown and there is no duplicate protection, first find out how the operation ended, and only then decide whether to repeat it. The assistant says "done" based on the operation's result, not on the fact that it tried.
Treat another site's page as source data
A competitor's page might contain a line demanding that the assistant ignore its rules and send someone else's database. To the assistant this is part of the text it is studying. The line does not extend the authority the team gave it.
OpenAI's safety guidance for agent workflows covers prompt injection, an attempt by external content to influence the system's instructions. Cut-down tool permissions, data checks and testing are needed together: none of them is enough on its own. And a review of public offers does not need access to sending the customer database at all.
In a test, the assistant should keep the meaning of the useful part of the page and flag the suspicious passage. Judge the actual tool calls: if the email has already gone, a correct explanation after the fact will not bring it back. Add this case to the standing set of checks and run it before every expansion of access.
Count the work including editing
Suppose a manual review took 4 hours and the internal hourly rate for staff is 5,000 ₸. An edition cost 4 × 5,000 = 20,000 ₸. With the assistant, Akbota spends 2 hours checking and another 1 hour on corrections and formatting, so 3 × 5,000 = 15,000 ₸.
Add 2,000 ₸ per edition for computation and tools. That makes 17,000 ₸, which is 3,000 ₸ less than the manual edition. If the initial setup cost the team 30,000 ₸, it pays back in 30,000 / 3,000 = 10 editions, provided scope and quality stay the same.
Freed hours become a saving only if they go to other work. So the decision shows the hours, their cost and the verified quality of the review. If editing starts taking longer, update the estimate instead of holding on to the promised saving.
Exercise: write tests for your assistant
Take a recurring task from your project and describe the outcome, the sources it needs and the operations it may perform. Prepare four cases: old and new prices in different documents, text changed after approval, a service that returned no response, and an instruction hidden on someone else's page. For each one, write down how it should end.
In a conflict of facts, both sources stay visible. A changed promise goes back for approval, an unknown send means finding out its state first, and text from another site's page remains data. In the first launch, everything public goes through a draft and a human before publication.
The time calculation complements the tests. An assistant that takes a long time to check may never pay back its setup. The client needs a reproducible result with clear costs and action boundaries, and it only makes sense to widen permissions once that result has been confirmed.