Product teams assume their models will flag their own security failures before launch. That assumption has already removed the review step from three separate agent pilots in ministry tools.
The bias surfaces as a quiet confidence that higher output quality replaces external checks. Teams ship faster because the model sounds coherent and the metrics look clean. What disappears is any process that asks whether the output could cause harm in a real ministry setting.
John Wesley’s three rules expose the flaw. The first rule, do no harm, was never meant to be satisfied by good intentions or polished results. It required an active step to examine the action before it reached people. Modern product defaults treat that step as optional once the model passes internal tests.
This is the foundational misread that causes product teams to treat security as a quality problem instead of a presence problem. When the model generates acceptable text, the team moves on. The absence of a human who must sign off creates exactly the conditions Wesley warned against: harm that looks reasonable until it lands in a local church.
How the Bias Shows Up in Agent Defaults
Agent builders set defaults for speed and coherence. The system prompt rewards fluent answers and penalizes refusals that feel slow. In practice this means the model will generate a children’s ministry outline or a counseling response without checking whether the source material was licensed or the advice fits the age group.
Observed pilots showed the pattern clearly. One team built an agent to draft volunteer schedules. The model produced clean tables and avoided obvious conflicts. No one ran the output against the church’s actual volunteer database because the internal accuracy score was high. The schedule was sent to print before anyone noticed it assigned a registered sex offender to the nursery.
A second pilot used an agent to summarize sermon feedback. The summaries looked useful until a staff member noticed the model had pulled direct quotes from private prayer requests that had been entered in the same form. The team had assumed the model would respect context boundaries because its training data was clean.
These failures did not come from bad models. They came from the decision that the model’s output quality was sufficient proof that no external review was needed.
The Rule That Forces a Human Print Step
Wesley’s first rule demands an explicit pause before action. In product terms that pause must be a required human step attached to any output that touches real people. The print step works because it cannot be faked by the model and because it forces someone to own the result.
Curriculum products built for children’s ministry already use this pattern. Drafts are generated, then forced through a human who must physically approve before the file reaches volunteers. The approval is not a quality gate about writing style. It is a presence gate that asks whether this content belongs in a room with seven-year-olds.
The same gate applies to agent outputs. When an agent produces a counseling script, the print step requires a licensed counselor to initial the page before it is shown to a user. The model can generate the text in seconds. The human step still takes minutes. That minutes-long delay is the feature, not the bug.
Without the print step, the bias reasserts itself. Teams celebrate the speed and quietly drop the review. Within two cycles the review process is treated as legacy rather than required.
Rebuilding the Review Without Slowing Shipping
The review can be rebuilt by separating the fast generation loop from the slow presence loop. Generation stays automated. Presence stays human and mandatory for any output that will reach a ministry context.
One working pattern splits the agent into two stages. The first stage produces a candidate response and tags it with a risk score based on content type. Any response tagged above a low threshold moves to a queue that requires a named reviewer to approve before the response is released. The queue is visible to the whole team so no item sits unclaimed.
A second pattern attaches the human step to the data rather than the text. Before an agent can draw from a church’s internal notes or prayer requests, a steward must mark that dataset as cleared for agent use. The clearance is time-limited and tied to a specific project. This prevents the model from quietly incorporating sensitive material that was never intended for automated systems.
Teams that adopted both patterns shipped at nearly the same cadence as before. The difference was that every high-risk output carried an accountable name attached to it. The model still produced the draft. The human still had to be present.
Your Turn: Apply This Today
- Pick the current agent build and list every output type it can produce that touches children, counseling, or private data.
- Write a one-sentence rule that forces a named human to approve before any of those outputs leaves the system.
- Add a visible queue in the admin panel that shows pending approvals and who is responsible for each one.
- Run the agent on last week’s real data and force yourself to print and initial the three highest-risk responses before they would have shipped.
- Set a calendar reminder for 48 hours after any new dataset is connected to confirm the clearance step was actually completed.
- Document the single slowest review that occurred this week and decide whether that delay protected people or was pure process theater.
The Prioritization That Quietly Dropped Security Reviews and The Trust Step Kent Beck Made Non-Negotiable both trace the same pattern of reviews that disappeared once metrics looked acceptable.
I consult with product leaders building AI agents for ministry contexts on security review gates and human presence requirements. Let’s talk.