Agents and Tool Use · Making It Safe · lesson 7 of 7
Human in the loop
about 18 minutes · free · runs in your browser
Ask before the irreversible
Some actions can be undone and some cannot. Sending an email, charging a card, deleting a record, merging a pull request — for those, the right design is not a better prompt. It is a pause: describe what is about to happen, and wait for a person to say yes.
The rule that makes this practical rather than exhausting: gate by consequence, not by tool. Reads never ask. Reversible writes never ask. Irreversible or externally visible actions always ask, every time, no "remember my choice" — because the choice was about one specific email to one specific person.
if requires_approval(tool_name, args):
return pending(describe(tool_name, args)) # nothing has happened yet
The description matters as much as the pause. "Run tool send_email?" is a dialogue people click through in a week. "Send an email to 4,182 recipients?" is one they read.
Your turn: write gate(tool_name, args, needs_approval, approvals) returning
("run", None), ("ask", description) or ("run", None) again once approved.
The description must name the tool and the number of affected items when args has a
count.
You start from this, and edit it in the browser:
def describe(tool_name, args):
"""A sentence a person can act on."""
return tool_name
def gate(tool_name, args, needs_approval, approvals):
"""Return ('run', None) or ('ask', description)."""
return ("run", None)