Workshop #005 · read first, then run it yourself

The Horse That
Opens Gatesand stops at every one

The same animal from the first session starts doing the actual work. The thing that makes that safe is that it will not touch a latch until you say so.

By the end of today you will know what an agent actually is, what it can and cannot reach, and exactly what happens at the moment before it changes anything.

Presented by Emile du Toit
brainitconsulting.com

Where we got to

Three sessions in, and the room is ready.

The horse predicts the next word. The saddle is your standing instructions. The saddlebags are tools.
One folder, one job — the line round the work.
The tack room is the editor: your files on the left, the open page in the middle, and the assistant beside them.

Everything so far, the assistant only talked about. Today it starts doing.

Before you startWhere the assistant moves in. A free route and a paid one.
The horse that opens gatesSame animal. Put to work.
It stops at every gateThe most important thing in this session.
What's in the bags nowFour things it can actually do.
Taking the reins backStopping it is normal, not failure.

Then the questions this always raises, the glossary so far, and the picture to photograph.

Before you start

Workshop #004 done. VS Code installed, your folder open in it, one real file in reference.
A decision about paying. This is the workshop where the assistant moves into your folder, and the good ones cost about $20 a month. There is a free route in Lab 1. It carries you comfortably through #006, works with more effort as far as #010, and runs out at #011 — and Lab 1 says plainly where and why.
About an hour. Longer than the last four, because you are actually driving now.
A job where being wrong is cheap. Not the invoice run. Something you could throw away.

Read the chapters first, then work through the labs. If you would rather not pay anything, do Lab 1 the free way — you paste instead of watching it type. Nobody needs to spend money today, and you will know from doing the work whether it is worth it later. The setup page has both routes in full.

The horse that opens gates

Nothing has been replaced. Something has been added.

A riding horse takes you somewhere and brings you back. A working horse does a job on the property — pulls the load, moves the stock, and yes, gets a gate open when a gate is in the way. Same animal, same training, different work, and rather different tack.

That is what has changed. In the first session you had a horse and a set of reins: you asked, it answered, and everything it produced arrived as words you then had to carry somewhere yourself. Last session we walked into the room where your files are. Today the horse comes into that room and starts picking things up.

What actually changed, in one line each

Sessions one and two. It could talk, and it could use tools. You did all the fetching and carrying.
Sessions three and four. We found the room where your work lives, and fitted it out.
Today. It can open your files, change them, and run things — inside that one folder, and only when you say yes.

The word for this is an agent, which sounds like something from a film and means something very dull: a model that has been given a goal, some tools, and permission to keep going until the job is done. You met the idea in session one as the loop. Today you meet it as a thing on a screen.

Nobody fetched a smarter horse. They just put this one to work.

Lab 1 — Bring the horse into the room 20 min

Two routes to the same place. Read both, pick one, and do not feel obliged to spend money to keep up.

The free route — no card, no install

You keep the browser chat you have used since #001, and you do the carrying yourself. It is slower and it teaches the same ideas.

Put the browser window and VS Code side by side. On Windows: Windows key + left arrow, then click VS Code. On a Mac: hold the pointer over the green button and choose Move & Resize → Left.
Open a file from your reference folder in VS Code, select all (Ctrl + A), copy, and paste it into the chat.
Ask for what you want. When it answers, copy the result back into a new file in finished.

That copying back and forth is what the paid route removes. Everything else — the standing instructions, the gates, judging the work, knowing what to ask for — is identical, and it is the part that actually takes learning.

How far the free route carries you, honestly

I would rather tell you this now than have you find it out at workshop nine.

#006 — no difference worth mentioning. You paste your instructions file in at the top of each conversation instead of it being read automatically. One extra paste.
#007 — mostly fine. All the git work is buttons in VS Code, and you keep every one of them. What you give up is asking “what has changed since the last marker?” in English — you read the change in the Source Control panel instead, which is less pleasant and tells you the same thing.
#008 — three labs out of four are pure conversation. Writing the brief goes just as well in a browser, and arguably better, because you have nothing to build with and are forced to think first. Only Lab 3 builds from it, and that is the paste-in, paste-out routine above.
#009 — fine, by clicking. Lab 2 has a route that never touches a command line, and you can run the questions in the database’s own console.
#010 — entirely free. Every step is a click on a website. Publishing needs nothing installed.
#011 and #012 — this is where it stops. Both ask the assistant to write files into your folder and then run them. Doing that by copying and pasting is an evening of tedium rather than an hour of work, and you will not enjoy it.

So: do not spend anything today. Work free through #008, which is where the thinking is. If you are still going by #009, that is the signal — you have used it for a month on real work and you know what it is worth to you. That is a much better way to decide than my telling you now.

The paid route — the assistant inside the folder

Install one of them. claude.com/download for the desktop app, or the VS Code extension — press Ctrl + Shift + X, search Claude Code, and check the publisher says Anthropic before installing anything. For Codex, start at chatgpt.com/codex and look for OpenAI.
Sign in. Claude Code needs a Pro plan; the free claude.ai account will not open it.
Make sure it is pointed at your folder from #004 and nothing wider. The title bar tells you.
Set it to ask every time. New Claude Code sessions start in Auto, where a second model approves its actions instead of you, so you would never see a gate. Click the mode button at the bottom of the prompt box in VS Code, or next to the send button in the desktop app, and pick Manual.

Full install steps for Windows and Mac, including the terminal versions, are on the setup page.

The first thing to ask it

Do not give it work yet. Ask it what it can see:

What files are in this folder? Do not change anything - just tell me what is here and what you think each one is for.

Read that answer carefully. It went and looked. Everything it names is in reach; anything it does not name is not. That list is the boundary, and it is the most important thing on the screen today.

If it lists files from outside your folder, stop and fix that before going further. You have pointed it at something wider than you meant to.

It stops at every gate

If you remember one thing from today, this is the one.

A working horse that opens gates sounds alarming until you see how it actually goes. It walks up to the gate. It stops. It waits. It does not touch the latch until the person with it says go. Every gate, every time, no exceptions, no matter how many times it has been through that gate before.

On screen this is the permission prompt, and it is what makes this session safe. Before the assistant changes a file, creates a file, or runs a command that could change something on your computer, it stops and tells you exactly what it is about to do. Nothing happens until you answer.

Fig. 1 — The permission prompt. It is not a formality and it is not a warning — it is the horse waiting for you.

What the prompt is telling you

It will name the file, and show you what it wants to write. Read the file name at minimum. Most mistakes announce themselves right there — a file you didn't expect, in a place you didn't expect.

Yes — go ahead, this once.
No — don't. It stops and asks what you'd rather it did. Saying no is not an argument; it is steering.
Yes, and stop asking for this kind of thing — convenient, and the one to leave alone for now.

Three ways to ride, and which to pick

Ask me every time. The gate stays shut until you open it. Start here. Stay here for a good while.

Go ahead on your own. It stops asking about edits and just works. Useful once you know a job well — and only in a folder where a mistake costs you nothing.

Just tell me the plan. It works out what it would do and shows you, without touching anything. Excellent for "what would this take?" and completely safe.

The middle one is where people get themselves into trouble, and always in the same way: they turn it on for a job they understand, then leave it on for a job they don't.

Lab 2 — Stand at the gate and say no 10 min

The permission prompt is the single most important thing in this workshop, and most people click through it within a day. Slow down here on purpose.

Ask for something that changes a file

Make a file called test.txt in this folder with three lines of nonsense in it.

Now read the gate before you answer

It stops and asks. Before you click anything, read what it is actually proposing:

What action? Writing a file, editing one, running a command.
On what? The exact filename. Is it the one you meant?
Where? Inside your folder, or somewhere else?

Say no

Decline it. Watch what happens: it accepts that and waits. Nothing breaks, nothing sulks, nothing is half-done. Saying no is ordinary, and knowing that from experience is what stops you clicking yes out of nervousness.

Then say yes, and go and look

Ask again, approve it, and then open test.txt yourself in the editor. The file is real. It is on your disk. It will be there tomorrow.

The one to be careful with

Somewhere there is an option like “don't ask again” or “allow all”. It is genuinely useful later, on a folder where nothing matters. It is a bad idea today, and a worse idea on a folder holding real customer work.

The gate is not the software being timid. It is you keeping the reins, and it costs you one second.

What's in the bags now

Session one's saddlebags, made real.

In the first session the saddlebags were an idea — the things a model could be given so it could act rather than only talk. Sitting in your folder, they stop being an idea. Here is every one of them, and the list is shorter than you would think.

Fig. 2 — Four capabilities. Two of them stop and ask before they happen.

"Run a command" is the one that makes people sit up, so let us be plain about it. It means the assistant can do the sort of thing you did in the black panel last session — check a version, count some files, start something. It asks before it reaches outside the folder you opened it in, and before any command that could change something. Commands that only look, like listing the files, it runs without asking.

What is not in the bags matters just as much. It has no access to your email unless you connect it. It cannot see your other folders. It has not been given your bank, your accounts package, or your phone. Those connections exist and are useful, and they are a later session, deliberately.

Lab 3 — A real job, start to finish 20 min

Now the thing the last four workshops were building towards: it reads your real file and writes a real result, and you never paste anything.

Give it the job

Adapt this to your own work. The shape matters more than the words — what to read, what to do, where to put it.

Read everything in reference/ first so you know how we work. Then read each file in inbox/ and write a reply for it. Save each reply into finished/, named after the customer. Match the tone of what is already in reference/. If anything is missing that you would need, stop and ask me rather than guessing.

Nothing in inbox/ or reference/? Dale’s rate card, notes and three inquiry emails are in #003, chapter one, each with a copy button. Copy them in and this lab runs on a real job with numbers you can check.

Watch what it does, not just what it produces

It reads the reference material because you told it to, and you can see it doing so.
It stops at a gate for every file it writes.
If something is genuinely missing, it should ask. If it guessed instead, that is worth knowing about it.

Then judge it honestly

Open what it wrote. It will be roughly right and wrong in a couple of specific ways. Do not fix those by hand — tell it what is wrong in a sentence and have it do them again:

The second one is too formal and you invented a delivery date. Redo both. Never invent a date - leave a blank for me instead.

“Never invent a date” is a rule you have just discovered by doing the work. Write it down. In #006 those rules move into the folder itself so you stop repeating them.

Taking the reins back

Stopping it is ordinary. Riders do it constantly.

Sooner or later it will set off in a direction you did not intend — usually because you asked for something more loosely than you thought. Nobody watching this for the first time expects to be allowed to interrupt, so it is worth saying plainly: you can stop it at any moment, and doing so costs nothing.

The three ways you steer mid-job

Stop it. The escape key. It halts where it is. Nothing is half-broken, because anything it had already done, it had already asked you about.
Say no at the gate. When the prompt appears and it is about to do the wrong thing, decline. It stops and asks what you would prefer.
Just tell it. "No, not that file — the one in past-estimates." It is a conversation, and correcting it mid-job is the normal way to work, not a sign anything failed.

When it asks you a question, that is it working properly

Sometimes it will come back with a question rather than an answer — which tank size, which of these two files did you mean, do you want this sent or drafted. That is the behaviour you want. Dale's own rules say don't guess a price, and a horse that asks rather than guesses is one you can leave a job with.

There is one more thing worth knowing before next session. Everything above is steering while you are watching. What none of it gives you is a way back after the fact — if you approve a change to your rate card on Tuesday and realise on Thursday it was wrong, none of these buttons help. That is exactly what session seven is for.

Lab 4 — Take the reins back 5 min

Interrupting is ordinary. Riders do it constantly and nobody thinks twice. It is worth doing once deliberately so it is not frightening at the moment you actually need it.

Set it off on something long

Go through every file in this folder and write me a one-line summary of each, one at a time, explaining your reasoning as you go.

Now stop it mid-sentence

Press Escape. In some tools it is Ctrl + C in the terminal. It stops, mid-thought, and waits for you.

What is true after you stop it

Nothing is half-written into a file — anything it wrote, it wrote through a gate you approved.
The conversation is still there. You can redirect rather than restart.
You have lost nothing but the tokens it had already spent.

Then redirect it: “stop doing that, just do the three files in inbox/”. Steering mid-ride is normal work, not a recovery from failure.

The two habits that matter: stop it the moment it is going the wrong way, and never let it run unattended on anything that matters. Both come free with the Escape key.

Questions people actually ask

The ones that come up the moment it can change something.

Can it delete my files?

Only through a gate you opened.

Inside the folder you opened it in, yes — and it will stop and tell you before it does. It cannot touch anything outside that folder. The honest risk is not that it goes rogue; it is that you get comfortable and start clicking yes without reading, which is why we work on copies until session seven.

Could I break my computer with this?

The horse is in one stall, and the door is latched.

Practically, no. It works in the folder you opened, it asks before it runs anything that could change something, and nothing on this list touches Windows or macOS itself. The realistic bad day is a folder of files in a mess — annoying, recoverable, and the exact thing session seven makes trivial.

Is it uploading my files to train itself?

The horse reads in your room. It doesn't take the papers home.

What it reads goes to the company's computers so it can answer — the same as when you pasted into a browser in session one. Whether those conversations may be used to improve future models is a setting in your account, and it is worth looking at once and deciding. The model itself is not learning your business as it goes; it starts each conversation knowing nothing but what is in the room.

Plain words

Everything the series has named so far. Today's are marked.

This list grows every session and always shows the lot, so you never need last week's notes to read this week's.

Large language model (LLM) 001: The engine that predicts the next word. The horse.
GPT 001: Generative — it makes new text rather than looking up a stored answer. Pre-trained — all its learning happened in advance. Transformer — the design of the machinery underneath. A breed name, not a job title.
Knowledge cutoff 001: The date its training stopped. It knows nothing after it, and doesn't know that it doesn't. The last day the horse was out in the world.
Prompt 001: What you type. A pull on the reins.
Chatbot 001: A model you can talk to, turn by turn. Horse plus bridle.
System prompt / instructions 001: Standing orders sent with every message, whether you type them or not. The saddle.
Context window 001: How much of the conversation it can hold at once. How far it can see on this ride.
Token 001: A chunk of a word — how length is counted, and how you're billed. Sugar cubes.
Hallucination 001: Making something up and sounding certain. Shying at a shed snakeskin.
Tool 002: A specific action it's allowed to take in the real world. A saddlebag.
MCP 002: An agreed standard for plugging tools into a model. Standard-size buckles.
Agent 002: A model given a goal, tools, and permission to keep going. A working horse, not a show pony.
Agentic loop 002: Look, decide, act, check, repeat. The ride itself.
Human in the loop 002: A person approves before something real happens. A hand on the reins.
Automation 002: The same work happening without you starting it each time. The horse knows the route.
File 003: A thing with a name and contents. A single piece of gear.
Folder (directory) 003: A box holding files, and sometimes other folders. A shelf.
Project 003: One folder holding one job's worth of everything. The room, with the door shut.
Path 003: The written address of a file — which boxes it sits inside. Directions to the shelf.
Editor (VS Code) 004: A window showing you one folder and everything in it. The tack room.
Terminal 004: A panel where you type an instruction to the computer directly. Talking to the stable itself.
Install 004: Putting a program on your own machine, once. Building the room.
Permission prompt 005: The stop before it changes anything, showing what it plans to do. The gate, and your hand on the latch.
Approval mode 005: Whether it asks every time, works on its own, or only shows a plan. How loose you're holding the reins.
Interrupting 005: Stopping it mid-job with the escape key. A pull on the reins. Ordinary.

Everything on one page

Photograph this before you go.

1 · It can act

Read, write, run, look things up — inside one folder.

2 · It stops at the gate

Every change, every command. You open the latch.

3 · You can stop it

Escape halts it. Saying no is steering, not failure.

Next session

4 · Driving it

Describing a job, and writing the house rules down.

And there is still no undo. Until we fit one, work on copies of anything you would be sorry to lose. Ten seconds of copying buys you every mistake for free.

Next session

#006 — Driving the Working Horse

Today was what it is and what it will not do without asking. Next time is how to drive it: describing a job so you get the thing you wanted, writing your house rules into the folder so you stop repeating them, and choosing between the two of these worth using.

Before you start it: nothing. Just turn up.

Want someone to hold the reins with you?

I do this for a living, and love to help people.

Thirty-plus years in enterprise software and a computer science degree — which mostly means I have watched a great many horses bolt, and I can usually tell you which ones are worth saddling before you spend money on the saddle.

In person

Your team, your room, your actual work on the whiteboard instead of somebody else's examples.

Over video

The same session, at your desks, with fewer chairs to stack afterwards.

Built for real

When the idea survives the workshop and somebody has to go and build the thing — that part I do too.

Fun fact — I rode to school on horseback as a kid in South Africa. So the metaphor isn't borrowed. I've done the falling off in person.

Emile du Toit brainitconsulting.com

Workshop #005 · The Horse That Opens Gates

The Horse ThatOpens Gatesand stops at every one

Contents