Anthropic opened a research preview of Claude Duet last week, and most of the coverage focused on the headline: an agent that messages you first. It sends a morning brief, watches connected apps like Gmail, Slack and Shopify, and only interrupts you when something needs a decision.

That's a nice demo. The more useful thing for anyone building products is how it decides what it can do without asking.

The approval model is the real feature

According to early coverage, Duet splits actions into tiers. Reading, drafting and preparing work happen on their own. Sending a message, making a payment, signing a document or deleting anything stops and waits for a yes. Purchases get a second spend-approval step, and payments go through a virtual card so the agent never holds the real card number. A few things, like trading securities, are off the table even with approval.

Look at how plain that is. It isn't a clever safety classifier. It's a short list of verbs, sorted by how much it hurts when they go wrong.

Most teams we talk to do this backwards. They give an agent a broad set of tools, then try to catch bad behavior with prompts and monitoring after the fact. Duet's shape suggests the opposite: decide what the agent may do silently, and make everything else a deliberate handoff to a human.

Three tiers you can steal this week

If you're shipping any agent feature, write down every action it can take and put each one in a bucket.

Free: read, search, summarize, draft. Reversible, no side effects outside your system.
Approve: send, publish, charge, sign, delete. Show exactly what will happen before the user taps yes.
Never: anything where a mistake can't be undone and the upside is small. Don't offer an approval button for these at all.

The "approve" tier needs more care than people expect. An approval prompt that says "Allow this action?" is worthless. The user has to see the actual email, the actual amount, the actual order. If they can't tell what they're approving, you've built a rubber stamp.

Polling is a design choice you inherit

One detail that's easy to miss: Duet reportedly checks accounts every few hours, not continuously, and can miss items that land between checks or misjudge urgency. That's a sensible tradeoff for a personal assistant. It's a problem if you copy it into a business workflow.

If your agent watches a Shopify store, a failed payment webhook or a spike in refund requests shouldn't wait for the next sweep. Use events for anything time-sensitive, and keep the scheduled sweep for summaries. Mixing the two is fine. Using only polling and calling it "proactive" is how you get an agent that tells you about the outage after your customers did.

What this means for ecommerce teams

Shopify being on the connector list matters. Agents will soon read your orders, draft your customer replies and maybe adjust your products. Two practical consequences:

Your app permissions and API scopes are now an agent's permissions too. Audit them. Anything broader than a human on your team would get is a liability.
Clean, boring data wins. An agent drafting replies from messy product titles and inconsistent tags will produce messy replies, quickly and at scale.

The takeaway

Proactive agents aren't a model problem anymore. They're a product design problem: what runs silently, what asks first, and what never runs. Teams that sort those buckets before they build will ship something users trust. Teams that sort them after an incident will do it in public.

We're here to help founders and teams design and build digital products that are built to scale with you, not slow you down. If you're looking to build something, get in contact with us today!