Module 5 · Lesson 6 of 6 · Emerging
A person approves the risky steps
Ask before acting
Tools that change things wait for a person's yes, and that rule lives in code, not in the prompt.
Scene 1 of 4 · Safe steps run alone
Searching and checking tables change nothing, so the agent runs those tools on its own.
- Agent + your code — healthy
- You — healthy
- Booking system — healthy
| Tool | Check |
|---|---|
| search_restaurants (highlighted) | Runs alone |
| check_table (highlighted) | Runs alone |
| book_table | Needs approval |
| send_email | Needs approval |
- Safe steps run alone. Searching and checking tables change nothing, so the agent runs those tools on its own.
- A risky step. Booking is hard to undo, so book_table is marked "needs approval" in code.
- Show it exactly. The agent shows the exact booking, with place, day, time and size, then waits for you.
- Only a yes runs it. Your yes is checked in code, and only then may the booking tool run.
- Now you try. The agent asks: book Rosa's, Friday, 7 pm, 4? Pick your answer. For example: Not booked: the agent stops and asks what to change. Anything but a clear yes leaves the hard-to-undo step undone.
Scene 1 of 4: Safe steps run alone. Searching and checking tables change nothing, so the agent runs those tools on its own.
Key points
- Reading tools can run alone; changing tools cannot.
- Each tool is marked in code as safe alone or needing approval.
- The agent shows exactly what it will do, then waits.
- Anything but a clear yes leaves the risky step undone.
Some actions are hard to undo, such as paying, booking or sending a message. For these, the (A model that calls tools in a loop, deciding each next step from the results, until it can answer.) should ask a person first.
The agent shows exactly what it is about to do, and waits. If the person says no, it stops or asks what to change.
Agents are still a young area, so start with narrow tasks, small sets of tools and approval for anything that matters.
In system design: Mark each tool as safe to run alone or as needing approval, and enforce that in code, not in the (Everything sent to a language model in one request: instructions, context and the question.).