---
title: "Ask a person before an agent does what · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-features/agents-in-products/agent-approval-irreversible
id: AIF-70
level: Required
applies: ai-features
risk: money
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1212
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Ask a person before an agent does what cannot be undone

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Agents in products](https://agentwranglers.se/playbook/ai-features/agents-in-products.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AIF-70
- Level: Required
- Chapter: [Agents in products](https://agentwranglers.se/playbook/ai-features/agents-in-products.md)
- Rule: List every tool that spends money, deletes data, sends a message to other people or changes access. An agent may run one only after the user approves that exact action in your own interface.
- Check: A test lists every tool marked as needing approval. For each, a fake model calls it with no approval, and the tool does not run and the run ends waiting for approval. A test that approves one set of arguments and runs with another is refused.
- Risk: Money lost or taken twice
- Applies when: The project uses AI models.
- How: Mark each tool in its definition as needing approval or not, and let the tool runner enforce it, not the prompt. Show the user what will happen in plain words, with the amounts, the recipients and the records affected. Save the run as waiting, as [let runs pause and resume](https://agentwranglers.se/playbook/ai-features/agents-in-products/resumable-agent-runs.md) says. Run the action only with the approved arguments. A changed argument needs a new approval. Prompt injection can make a model call any tool it has, so this check must sit outside the model. The approval must come from the user's click, never from text the model writes.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### TypeScript example

```ts
export async function runTool(run: AgentRun, call: ToolCall) {
  const tool = tools.get(call.name);
  if (tool.needsApproval) {
    const approval = await approvals.find(run.id, call.name, hashArgs(call.args));
    if (!approval) return run.waitForApproval(call);
  }
  return tool.execute(call.args, run.user);
}
```

### Python example

```python
def run_tool(run: AgentRun, call: ToolCall):
    tool = tools[call.name]
    if tool.needs_approval:
        approval = approvals.find(run.id, call.name, hash_args(call.args))
        if approval is None:
            return run.wait_for_approval(call)
    return tool.execute(call.args, run.user)
```

## Sources

- [OWASP LLM03:2026 Excessive Agency](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM03_ExcessiveAgency.md)

## Related rules

- AID-27 [Approve destructive commands](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/approve-destructive-commands.md) in AI-assisted development
- AIF-17 [Make tools that change things safe to repeat](https://agentwranglers.se/playbook/ai-features/structured-output-and-tools/idempotent-tools.md) in AI features
- AIF-36 [Let a person decide what matters](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/human-decides.md) in AI features
- AIF-55 [Let runs pause and resume](https://agentwranglers.se/playbook/ai-features/agents-in-products/resumable-agent-runs.md) in AI features
- AIF-74 [Run browser and computer-use agents in a throwaway session](https://agentwranglers.se/playbook/ai-features/agents-in-products/isolated-browser-agents.md) in AI features
- AGT-21 [Confirm risky actions with a token bound to the exact request](https://agentwranglers.se/playbook/agents-as-users/safe-actions/confirmation-token.md) in Agents as users
- AGT-81 [Keep the buyer's signed approval with each agent order](https://agentwranglers.se/playbook/agents-as-users/quotas-and-pricing/agent-mandates.md) in Agents as users
- AGT-68 [Give in-browser agents your tools](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/webmcp.md) in Agents as users

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-features/agents-in-products/agent-approval-irreversible">Agent Wranglers AI features playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Stop every agent run at fixed limits set in code](https://agentwranglers.se/playbook/ai-features/agents-in-products/agent-run-limits.md)
- Next: [End every agent run with a known status](https://agentwranglers.se/playbook/ai-features/agents-in-products/agent-run-status.md)
- [Agents in products](https://agentwranglers.se/playbook/ai-features/agents-in-products.md)