How do you keep humans in control of an agent's risky actions?

Summary

Classify tools by risk (read-only, reversible, destructive, external), enforce approval in the host's code for destructive and external actions, show approvers the exact arguments and blast radius, approve plans before execution for multi-step changes, and prefer dry runs, per-call limits and reversible operations.

Longer Answer

Approval enforced in a prompt can be talked around; approval enforced in code cannot. Too many prompts cause rubber-stamping, so auto-approve read-only and small reversible actions. Log approver, arguments and outcome.

Key Points

• Risk classes per tool.
• Gates in code.
• Show exact action and blast radius.
• Dry runs, limits, reversibility.

Deep dive: Human Approval for Risky Actions