Ask one question of each action: if it is wrong, can we undo it quickly and cheaply? Undoable actions run automatically, partly undoable ones run with a notice, hard to undo ones need a named approver, and irreversible high impact ones are blocked for agents altogether.
Why reversibility works as the test
Risk scoring models get argued about. Reversibility is concrete. A team can agree that restoring a deleted draft takes a minute and recalling a wire does not. OWASP's guidance lists "excessive autonomy" as a root cause of excessive agency and recommends human approval for high impact actions. Tiers say which actions count as high impact.
The four tiers
| Tier | Test | Examples | Control |
|---|---|---|---|
| 0 Auto | Fully undoable, low impact | Read public docs, create a draft | Log only |
| 1 Notify | Undoable with some effort | Edit a ticket, add a label | Log and notify the owner |
| 2 Approve | Hard to undo or outward facing | Send external mail, change production config | Named approver before the call |
| 3 Block | Irreversible and severe | Delete a production database, move funds | Agent cannot call it |
Steps to adopt
- List the agent's tools and, for each, write how you would undo a wrong call and how long that takes.
- Assign tiers using the table. Disagreements go to the sponsor.
- Configure enforcement at the tool boundary. A tier on paper that the client ignores is not a control.
- For tier 2, design the approval prompt to show the tool, the arguments and the likely effect. The MCP specification says clients should prompt for confirmation on sensitive operations and show tool inputs before calling the server.
- Track approvals and rejections. A tier with no rejections after months may be set too high, or approvers may be clicking through.
- Revisit tiers when a tool changes or an incident teaches you something.
Moving tools between tiers
Promotion down (less friction) needs evidence: a clean record, a narrower tool, a backup you have tested. Promotion up needs only a near miss. Make that asymmetry explicit in your policy.
Tier 3 is a real tier
Some actions should be impossible for an agent, not merely gated. If a person must do it, say so and remove the tool from the agent entirely.
Safeguard offers MCP Guardrail and agent identity for applying this kind of policy to agent tool calls, and you can run a free scan of your own repositories at gold.safeguard.sh/scan. Autonomous fix pull requests are off by default, and every category starts on Manual.
Quick check
Who approves tier 2 actions?
A named person or group with authority over the system, who is not the one who requested the task.
Can tiers differ by environment?
Yes. The same action can be tier 1 in a test system and tier 2 in production.
Sources
Last reviewed: 19 October 2026.
