We Gave AI Agents Real Tools — Then Realized “Just Ask Before Acting” Wasn’t Enough

Description and use

When AI agents gain real tools, the rule to ask users before important actions fails because of ambiguous importance and excessive model authority. The solution is to separate action planning from permission checks, use deterministic policies, explicit approval prompts, audit logging, and task‑scoped permissions.

Problem

When AI agents are given real tools, asking the user before any important action is insufficient because the model must decide what is important and whether to act, leading to ambiguous authority and potential unsafe actions.

Outcome

Separating action planning from permission enforcement, using deterministic policies, explicit approval prompts, and audit logging, the system prevents ambiguous authority and reduces risk when agents act on real tools.

Workflow

• Agent receives user request
• Agent proposes specific actions
• System classifies each action by impact
• Policy layer determines if approval is required
• If required, system presents explicit approval prompt to user
• User approves or rejects action
• Approved action is executed via tool
• Execution result is logged in audit trail

Evidence

Ask the user before doing anything important.

The model has to decide two things: What action should happen? Whether that action is important enough to require approval.

The approval decision happens outside the model.

READ → allowed WRITE → allowed or approval depending on context DESTRUCTIVE → approval required

If the permission system fails, the action should stop. policy error → block