Approval gates for AI agents: how Sahkarmi decides what a coworker may do

说明与用途

Sahkarmi 实现了权限模型，所有代理动作被划分为 16 类，其中 6 类需要人工批准。自动和一次性批准记录了到期时间，浏览器登录由人工完成以保护凭据。

问题

AI agents can perform irreversible actions (payments, deletions, form submissions) that, if hallucinated, can cause real harm; a system is needed to ensure human approval before such actions.

结果

Sahkarmi’s design reduces approval fatigue through sensible defaults, limits risky actions to human approval, and protects credentials via a browser take‑over flow, thereby preventing unintended or malicious agent actions.

工作流

• 1. Agent proposes a tool call.
• 2. Permission policy checks the call’s category.
• 3. If category is auto‑allow, action proceeds.
• 4. If category is auto‑deny, action is blocked.
• 5. If category is ask, a pending‑approval token is generated and an approval request is sent to the user (desktop or phone).
• 6. User reviews the request, optionally sees a diff of the effect, and approves or rejects.
• 7. Approval is recorded; delegated approvals expire after 30 days, single‑use approvals after 7 days.
• 8. Approved actions are executed; denied actions are logged and not performed.

证据

The model proposes. A human approves. The decision is recorded.

来源

Six categories are special. Payments, messages to customers or third parties, publication, shell commands, destructive file operations and official or government forms are hard‑coded to ask.

来源

The sandboxed browser is handed to the human, who signs in with their own hands; the coworker then takes the session back. The model never sees the password or the OTP.

来源