Agent high-impact action without human approval

Classify agent tools by impact and route every high-impact or irreversible call through an enforced human-approval step in the executor, with the decision logged.

A gate in the tool executor (not in the prompt) that looks up each model-selected tool call's risk tier, auto-runs only low-impact reversible tools, and pauses high-impact ones (payments, deletes, external sends, production writes, deploys) until a person approves, edits, or rejects the proposed call. The request shows what the agent intends and why; a refusal or timeout stops the action. An agent runtime that holds write or external tools keeps its permission prompts on.

Where it goes: 15 agent action surface, 3 config and feature flags.

What reviewers look for: on every path from a model tool call to a destructive, financial, or externally visible operation, an approval primitive (interrupt_before, interrupt(), needs_approval, can_use_tool, an approval queue) or a dry-run/propose step that a human confirms; no bypassPermissions, --dangerously-skip-permissions, auto_approve: true, or human_input_mode="NEVER" on an agent with such tools.

for call in response.tool_calls:
    result = TOOLS[call.name](**call.arguments)   # runs whatever the model picked

HIGH_IMPACT = {'issue_refund', 'delete_records', 'send_email'}
for call in response.tool_calls:
    if call.name in HIGH_IMPACT:
        decision = approvals.request(call, reason=response.text)   # blocks until a human decides
        audit_log.record(call, approver=decision.approver, approved=decision.approved)
        if not decision.approved:
            continue
        call = decision.edited_call or call
    result = TOOLS[call.name](**call.arguments)

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.