Approval gates for AI agents: how Sahkarmi decides what a coworker may do

Description and use

Sahkarmi implements a permission model where every agent action is classified into 16 categories, six of which require manual approval. Automatic and single‑use approvals are recorded with expiry, and browser logins are handled manually to protect credentials.

Problem

AI agents can perform irreversible actions (payments, deletions, form submissions) that, if hallucinated, can cause real harm; a system is needed to ensure human approval before such actions.

Outcome

Sahkarmi’s design reduces approval fatigue through sensible defaults, limits risky actions to human approval, and protects credentials via a browser take‑over flow, thereby preventing unintended or malicious agent actions.

Workflow

• 1. Agent proposes a tool call.
• 2. Permission policy checks the call’s category.
• 3. If category is auto‑allow, action proceeds.
• 4. If category is auto‑deny, action is blocked.
• 5. If category is ask, a pending‑approval token is generated and an approval request is sent to the user (desktop or phone).
• 6. User reviews the request, optionally sees a diff of the effect, and approves or rejects.
• 7. Approval is recorded; delegated approvals expire after 30 days, single‑use approvals after 7 days.
• 8. Approved actions are executed; denied actions are logged and not performed.

Evidence

The model proposes. A human approves. The decision is recorded.

Source

Six categories are special. Payments, messages to customers or third parties, publication, shell commands, destructive file operations and official or government forms are hard‑coded to ask.

Source

The sandboxed browser is handed to the human, who signs in with their own hands; the coworker then takes the session back. The model never sees the password or the OTP.

Source