Ask a person before an agent does what cannot be undone

How to do it

Mark each tool in its definition as needing approval or not, and let the tool runner enforce it, not the prompt. Show the user what will happen in plain words, with the amounts, the recipients and the records affected. Save the run as waiting, as let runs pause and resume says. Run the action only with the approved arguments. A changed argument needs a new approval. Prompt injection can make a model call any tool it has, so this check must sit outside the model. The approval must come from the user's click, never from text the model writes.

Examples

TypeScript example

export async function runTool(run: AgentRun, call: ToolCall) {
  const tool = tools.get(call.name);
  if (tool.needsApproval) {
    const approval = await approvals.find(run.id, call.name, hashArgs(call.args));
    if (!approval) return run.waitForApproval(call);
  }
  return tool.execute(call.args, run.user);
}

Python example

def run_tool(run: AgentRun, call: ToolCall):
    tool = tools[call.name]
    if tool.needs_approval:
        approval = approvals.find(run.id, call.name, hash_args(call.args))
        if approval is None:
            return run.wait_for_approval(call)
    return tool.execute(call.args, run.user)

How to check

A test lists every tool marked as needing approval. For each, a fake model calls it with no approval, and the tool does not run and the run ends waiting for approval. A test that approves one set of arguments and runs with another is refused.

Sources

• OWASP LLM03:2026 Excessive Agency

Related rules

• AID-27 Approve destructive commands in AI-assisted development
• AIF-17 Make tools that change things safe to repeat in AI features
• AIF-36 Let a person decide what matters in AI features
• AIF-55 Let runs pause and resume in AI features
• AIF-74 Run browser and computer-use agents in a throwaway session in AI features
• AGT-21 Confirm risky actions with a token bound to the exact request in Agents as users
• AGT-81 Keep the buyer's signed approval with each agent order in Agents as users
• AGT-68 Give in-browser agents your tools in Agents as users