Claudius Secretary
Personal-assistant system built on Claude Code — and a live study in where an agent's autonomy should end.
Problem
- I got tired of being a poor secretary to myself.
- The interesting design work all lives in the boundaries: which decisions the assistant makes autonomously, which it proposes, and which it never touches.
Approach
- Draft, never send — there is no send path; drafting is reversible, sending is not.
- Propose first, one action at a time — an ambiguous answer is not approval.
- A vocabulary that cannot lie: it says drafted, prepped, reminder set, armed — never sent, booked, done.
- The actor never grades its own work — a separate morning verifier checks real-world evidence before anything is marked done.
- Anything that notifies another person needs explicit per-item confirmation.
Outcome
- Each rule exists because the version without it made a mess I had to clean up.
- Autonomy boundaries are a product surface, and the cheapest place to learn that is on an agent whose only user is you.
The honest version: I got tired of being a poor secretary to myself, and Claude Code turned out to be the right substrate to fix it. Claudius is a kit of skills, hooks, and scheduled routines that handle the recurring work of being a person — inbox triage, capturing tasks the moment they’re spoken, daily briefings, drafting the follow-up emails I’d otherwise postpone forever.
It’s a working system, not a productized one — and the interesting design work all lives in the boundaries: which decisions the assistant makes autonomously, which it proposes for confirmation, and which it never touches. That’s the actual product question for any agentic tool, and these are the rules Claudius actually enforces:
- Draft, never send. The only outbound-email action in the system is create draft. There is no send path — even when a send tool is available in the session, the skill’s contract forbids it. Drafting is reversible; sending is not. I review in Gmail and press send myself.
- Propose first, one action at a time. Every outward action (a draft, a calendar hold, a label) is shown as a plan plus a preview and waits for an explicit yes. An ambiguous answer is not approval. Confirmations are never bundled.
- A vocabulary that can’t lie. The reporting layer reserves sent, booked, and done for things that actually happened — which, by rule 1, the assistant itself can never claim. It says drafted, prepped, reminder set, armed. A calendar hold is “a reminder for you to book,” never “booked.”
- The actor never grades its own work. The skill that takes actions is forbidden from writing completion markers; a separate morning verifier checks real-world evidence (did the reply actually land?) before anything is marked done. Failure paths cannot write “completed.”
- Anything that notifies another person — declining an event, anything with an external audience — needs explicit per-item confirmation, and is rare by design.
None of this is theoretical safety talk; each rule exists because the version without it made a mess I had to clean up. Autonomy boundaries are a product surface, and the cheapest place to learn that is on an agent whose only user is you.