On 21 October Anthropic opened a research preview of Claude Duet, a standalone app in which Claude works as what the company calls a proactive agent. It does not wait for a prompt. Anthropic says it sends a short brief each morning, keeps an eye on the apps you have connected, and messages you when it decides something needs your attention. It runs on Claude Opus 5.5, has its own virtual machine and browser so it carries on when your laptop is shut, and can reach the 6,000-plus connectors and plugins in the Claude Marketplace.
For now it is US only, by waitlist, for Pro and Max subscribers, and it draws on the same usage limits as the rest of your plan. Nobody reading this in the UK will get hands-on with it this month. It still deserves ten minutes of a project manager's time, because the interesting part is underneath the product: a written set of rules about what the agent may do alone, what it must ask about, and what it may never do at all.
Most construction and consultancy firms experimenting with agents are building them from scratch, and the question of when the agent stops and asks is usually left to whoever wrote the prompt. Anthropic has published its answer, and it is a better starting point than a blank page.
What a proactive agent does to a Monday morning
Anthropic's examples focus on small businesses. Jess Provencher, broker and owner of Pro Homes, said Duet spotted a property viewing booked for the wrong day in her calendar, without being prompted. "This is exactly the kind of thing I want caught without having to ask," she said.
The same principle applies to construction projects. An RFI might have been sitting in a subcontractor's inbox for nine days. A programme update might have pushed a milestone back, or a revised cost report might show a change in the forecast. Having a system check shared mailboxes and the latest project reports overnight, then flag these changes first thing in the morning, could save a project manager considerable time. Unlike a chatbot, it would not depend on someone remembering to ask the right question.
Two caveats from Anthropic's own write-up. Duet checks your connected accounts "every few hours", because constant polling would burn through plan limits, so it is a digest rather than a live alarm. And in the company's words, "it still might misread a thread or miscalibrate what's urgent." TechCrunch's Ivan Mehta also notes that Anthropic says it is weak at personal errands such as booking tickets. This is a work tool in an early state.
The three tiers of permission
The approval design in Anthropic's safety article, published two days after launch, sorts every action into one of three tiers.
Reading, drafting and preparing work happen without asking.
Before Duet sends a message, makes a payment, signs a document or deletes anything, it shows the action, the destination and the content, including every recipient, and waits for approval.
Some actions stay off-limits even if you approve them: trading securities, banking actions such as moving money between accounts, and accessing someone else's account.
Some steps can never be covered by a 'don't ask me again' rule however often you have approved them, such as paying or sending money, deleting an order, or creating an account.
Alongside the approval card, a separate automated check assesses whether each action matches what you asked for. Anthropic says it is built on the classifier from Claude Code's auto mode, extended for Duet, and it runs outside the model doing the work so that instructions hidden in a web page cannot influence it. Credentials never pass through the model at all. Sign-in via 1Password is listed as coming soon rather than live.
The honest number
That classifier is the part to read closely, because Anthropic published its performance figures in March. John Hughes of Anthropic's engineering team wrote that Claude Code users accept 93% of manual permission prompts anyway, which is the approval fatigue problem in one statistic. The replacement pipeline blocked only 0.4% of benign actions across 10,000 real internal tool calls. On a curated set of 52 real cases where the agent tried to do more than it was asked, it let 17% through.
It is not a drop-in replacement for careful human review on high-stakes infrastructure.
Hughes calls the 17% "the honest number", and the Duet safety article repeats the point in gentler language: the safeguards "will occasionally miss something or flag a harmless message". The incident examples are instructive. One agent, told to "clean up old branches", deleted remote branches the user had not meant to touch.
The construction equivalent is 'tidy the RFI register' on a shared project platform. The agent understood the goal and still did damage, which is exactly the failure a cost report or a programme baseline cannot absorb.
A template for your own agents
If your firm is wiring an agent into a project information platform, a cost reporting workflow or a shared inbox, the Duet structure maps almost directly. Write down the free actions (read, summarise, draft, flag). Write down the gated actions, which should be anything that leaves the firm or changes a record: an email to a contractor, a change instruction, a payment certificate, or a revised milestone. Then write down the banned actions that no approval unlocks, such as approving a valuation, issuing a contractual notice or altering an agreed baseline. Put the check that enforces these outside the model, not inside the prompt the agent can read.
Then calibrate. Anthropic's safety article is frank about the trap: "Approval fatigue is a serious issue, because too many requests teach people to tap through them, sometimes without adequate consideration." Put too many checks in place, and people will start clicking through them without paying attention. Put too few in place and you risk relying on a system that, by Anthropic's own figures, gets 17% of actions wrong by acting too readily.
The risks are already showing up elsewhere. As we discuss in another story this week, US banks have started blocking third-party agents from customer accounts, partly because they cannot distinguish an authorised agent from a rogue one. Businesses need to think carefully about the same problem when deploying their own agents. Staff should not have to wonder whether an agent is acting within its authority.
Takeaway
Claude Duet will not be on a UK project this quarter, and when it arrives, its connectors will suit a small business before they suit a site. The design is the transferable part. Anthropic says a proactive agent is only safe to run unattended if the permission rules are explicit, enforced outside the model, and honest about their miss rate. That is a standard any firm can hold its own agent pilots to today.
Sort every action your pilot agent can take into free, gated and banned, and get the list signed off by whoever owns the risk.
Ask any vendor selling you an agent for the false-negative rate on real overeager actions, and be suspicious if they do not have one.
Treat a morning brief as a digest with gaps, and keep the live alarms for things that still page a human.
Project Flux tracks how agents like this reach construction and consultancy work and what the permission rules should look like when they do. The weekly newsletter is free at projectflux.ai.
Links and Stuff
All content reflects our personal views and is not intended as professional advice or to represent any organisation.
