Permission, and the person in the loop
By the end: Classify an agent’s actions by reversibility and decide which require a person to approve.
Reading is cheap to get wrong. Writing is not. The most useful thing you can do before giving an agent tools is sort every action by what happens when it is wrong.
- Reversible and private: read a record, search docs, draft text nobody has seen. Let the agent run.
- Reversible but visible: update an internal note, move a ticket, add a tag. Let it run, log clearly, make undo easy.
- Irreversible or outward-facing: send an email, charge a card, delete data, publish anything. A person confirms, every time.
Confirmation is only real if the person can actually judge it. "Allow this action?" teaches people to click yes. "Send this email to 1,240 customers?" with the text and the recipient count is a decision. Show what will happen, at the scale it will happen, in the words the recipient will see.
And enforce permission in your code, not in the prompt. A system prompt saying "never issue refunds" is a request; not giving the agent a refund tool is a guarantee. Where a tool must exist but be restricted, check the restriction where the tool runs, where no wording can talk it out of the check.