We Gave AI Agents Real Tools — Then Realized “Just Ask Before Acting” Wasn’t Enough

说明与用途

当 AI 代理获得真实工具时，要求用户在重要操作前确认的规则不足，因为重要性的定义模糊且模型拥有过多权限。解决方案是将行动规划与权限检查分离，使用确定性策略、明确的批准提示、审计日志以及任务范围权限。

问题

When AI agents are given real tools, asking the user before any important action is insufficient because the model must decide what is important and whether to act, leading to ambiguous authority and potential unsafe actions.

结果

Separating action planning from permission enforcement, using deterministic policies, explicit approval prompts, and audit logging, the system prevents ambiguous authority and reduces risk when agents act on real tools.

工作流

• Agent receives user request
• Agent proposes specific actions
• System classifies each action by impact
• Policy layer determines if approval is required
• If required, system presents explicit approval prompt to user
• User approves or rejects action
• Approved action is executed via tool
• Execution result is logged in audit trail

证据

Ask the user before doing anything important.

The model has to decide two things: What action should happen? Whether that action is important enough to require approval.

The approval decision happens outside the model.

READ → allowed WRITE → allowed or approval depending on context DESTRUCTIVE → approval required

If the permission system fails, the action should stop. policy error → block