Your First Automation Should Fail Safely

On June 18, 2021, every HBO Max subscriber woke up to an email with the subject line "Integration Test Email #1" and a body that read, "This template is used by integration tests only." The company later blamed an employee (widely reported as an intern) who ran a test against the live subscriber list instead of a sandbox. Nobody reviewed the send. Nobody saw the subject line before it reached real customers.

That's what a workflow looks like when nothing sits between the automation and the world.

If you're building your first automation, what protects you from your own HBO Max moment isn't "being careful." It's how you set the workflow up on day one. Your first automation should fail safely, which means the worst case is that you ignore a notification on your phone. This guide walks through a 15-minute setup that gets you exactly that, using a common starting workflow: sending a post-purchase welcome email after a new Stripe checkout.

What "Fail Safely" Means for Your First Automation

A workflow that fails safely has one property: nothing touches the outside world without you agreeing. The AI can draft, summarize, categorize, score, and propose. Sending, deleting, charging, and posting all wait for a human tap.

Most tutorials skip this. They teach you "trigger happens, action runs" and leave the consequences as homework. For a first workflow, that's backwards. A beginner needs to see three things clearly: here's the thing that fires, here's what it wants to do, and here's where you say yes or no.

AI researchers call the pattern human-in-the-loop, but you don't need the jargon. You need one rule. The first version of your workflow should never send anything you haven't seen. Why human review is the missing piece in AI automation covers the case in more depth, but we'll build it here.

The 15-Minute Setup: Stripe Checkout, AI Draft, Phone Approve

Pick one workflow to start with. We're building a post-purchase welcome email for new Stripe checkouts because it's a common use case, the risk is bounded to one message per completed checkout, and the failure modes are easy to spot.

What you need:

• A Stripe account with at least one test checkout
• A Rills account (free to start)
• Your phone

Step 1: Trigger on the right event

Stripe emits a checkout.session.completed event whenever a customer finishes a Checkout session successfully. Rills listens for it over a webhook, but you don't have to write any webhook code. We handle that part automatically. Stripe's webhooks quickstart describes what's happening under the hood, but in Rills you just pick the event from a dropdown.

Trigger: Stripe Checkout Session Completed.

Step 2: Let AI draft, don't let it send

Add an AI step after the trigger. Give it a boring, specific prompt:

You are writing a short post-purchase welcome email to a new customer of [your business name] who just completed checkout. Use their first name if available. Two short paragraphs. Friendly but not over-eager. Thank them for the purchase and mention one next step (book an onboarding call, or reply with questions).

This is the step that would normally terrify a burned skeptic since AI is writing customer-facing text, but the approval step that comes next keeps it safe.

Step 3: Add an approval gate

Drop a Human Review step in after the AI draft. When the workflow runs, the draft lands in your mobile queue. You see the customer's name, the email address, the generated draft, and two buttons. Approve or reject.

In Rills, approvals are free. The workflow pauses until you swipe, and it holds that paused state at no cost for as long as you need.

Step 4: Send the email (only after approval)

Add a send step after the approval. This is the only node in the workflow that touches the outside world, and it only runs if you tap approve.

That's the whole thing. Four nodes, one of which waits for you indefinitely.

What Could Go Wrong (And Why You'd Catch It)

Beginners break their first workflow in predictable ways. An approval gate catches all of them.

The AI writes something weird. Welcome emails are easy, but AI will sometimes invent a product feature, use an odd tone, or hallucinate a next step. You'd see it on your phone before it went out. Reject, adjust the prompt, try again on the next customer.

The trigger fires on a test checkout. While you're testing your Stripe setup, you run a test checkout as "John Doe" with an email like test@example.com, and the workflow runs. Without an approval gate, that address (or nobody, or the wrong person) gets an email. With the gate, you see test@example.com in the queue and reject it.

The integration sends duplicates. A webhook retry, a flaky connection, or a mistakenly repeated checkout can fire the trigger twice. Without a gate, two emails. With the gate, you see two approvals pending and tap reject on one.

You change your mind about the template. You realize the draft style doesn't match your brand voice. The gate lets you change course before any customer has seen it, not after.

The HBO Max employee wasn't unqualified. They were working in a system with no gate, where "run the test" and "send to real customers" happened to be the same physical action. A beginner workflow with an approval step can't have that kind of accident, because sending is always one tap away from you and never triggered by anything automatic.

If you want a quick read on what welcome emails should and shouldn't include, Postmark's transactional email best practices is a great resource.

Why Mobile Approval Makes This the Default

Approval as a workflow step works because approving is fast and free.

It's fast because the queue lives in a phone-first interface. Open the app, see the pending action, swipe. Most approvals take under 10 seconds once you're in the habit.

It's free because Rills charges credits for outbound actions (AI calls, sending the email, hitting an external API). Logic steps and approvals don't consume credits. The full breakdown is in how action credit pricing works, but the short version is that an approval step costs you nothing except the second it takes to tap.

And while the workflow waits for you, it isn't costing us anything. There's no polling cost, no running-timer penalty for taking hours or a day to review. Traditional automation tools often charge per check-in but Rills holds the paused state free until you act.

It matters because the cheapest way to make a workflow safe is to put a human in it, and that only scales if the human checkpoint doesn't carry a price tag.

Over time, Rills tracks which proposals you approve and which you reject. Once it has seen enough cases where you always approve a particular pattern (say, welcome emails to customers from a specific country, or drafts under a certain length), its confidence score for that slice climbs. You can opt to let it auto-send for that pattern. Edge cases, weird drafts, and new patterns still come to you. Getting started with AI agents as a solopreneur walks through this in more depth.

You approve in the beginning, let the boring middle auto-run once confidence is high, and keep approving the edges. The system gets out of your way as it earns its way out.

What to Build After This One

Once the Stripe checkout welcome workflow has run a few dozen times and you trust the pattern, you're ready for a second one. Not a riskier one, another low-stakes one.

Good candidates:

• New calendar booking triggers a follow-up prep email (AI drafts, you approve)
• New form submission triggers a Slack or Notion note with a suggested category
• New inbox message triggers a drafted reply saved to your drafts folder, never auto-sent

Things to avoid for now:

• Anything that charges cards, refunds, or moves money
• Anything that posts publicly (social media, forums)
• Anything that deletes or overwrites records

You graduate to higher-stakes workflows the same way you graduated the welcome email. Approve a bunch of times, watch the confidence score climb, let the safe patterns auto-run. The 15 minutes you spent setting up the first workflow is the same setup for the tenth. What changes is how much of it you still need to watch.

If you'd like to see this before building your own, try a live demo and swipe through a pending approval yourself. The whole point of Rills is that whatever sits between you and a customer email is always just one tap.