Sort agent actions by three questions: how much damage could it do, can it be undone, and how far does it reach. Low impact, reversible, local actions can run on their own. High impact, irreversible or outward facing ones should ask a human first. A few should be blocked outright.
Why a policy beats a feeling
OWASP describes three root causes of excessive agency: too much functionality, too many permissions and too much autonomy. Approval prompts address the third. But prompting for everything trains people to tap through, so the policy has to be selective.
The MCP specification says there should always be a human in the loop with the ability to deny tool invocations, and that clients should prompt for confirmation on sensitive operations. It leaves the definition of sensitive to you. This post offers one.
The three questions
- Impact. If this goes wrong, what is the worst case? Reading a public document is minor. Dropping a table is not.
- Reversibility. Can you undo it in a minute with no loss? Creating a branch can be undone. Sending an email or a payment cannot.
- Reach. Does it stay inside the sandbox, or does it touch other people, other systems or the internet?
Score each as low, medium or high. Two or more highs means ask or block.
A starter policy table
- Read files in the project. Impact: Low. Reversible: Yes. Reach: Local. Policy: Allow.
- Search the web. Impact: Low. Reversible: Yes. Reach: Outward read. Policy: Allow, log.
- Run tests in a sandbox. Impact: Low. Reversible: Yes. Reach: Local. Policy: Allow.
- Edit files in a working branch. Impact: Medium. Reversible: Yes. Reach: Local. Policy: Allow, review diff.
- Install a new dependency. Impact: Medium. Reversible: Mostly. Reach: Supply chain. Policy: Ask.
- Run a shell command. Impact: High. Reversible: Varies. Reach: Varies. Policy: Ask, or use narrow tools.
- Push to a shared branch. Impact: Medium. Reversible: Partly. Reach: Team. Policy: Ask.
- Send a message or email. Impact: Medium. Reversible: No. Reach: People. Policy: Ask.
- Change credentials or permissions. Impact: High. Reversible: Partly. Reach: Wide. Policy: Ask on a full screen.
- Delete data or resources. Impact: High. Reversible: No. Reach: Varies. Policy: Ask or block.
- Deploy to production. Impact: High. Reversible: Partly. Reach: Wide. Policy: Human gate.
Adjust to your own setting. The value is in having the table, not in these exact entries.
Make the tools narrower first
OWASP suggests offering only the extensions the model needs, and building tools with only the operations required, for example a dedicated file writing tool in place of a general shell tool. Every narrow tool you add is an approval you do not have to ask for. A tool that can only write inside one folder rarely needs a human to look at each call.
Authorization lives outside the model
OWASP advises enforcing authorization outside the model, validating each downstream request against policy rather than letting the model decide what is allowed. A prompt to the user is a human check. A policy check in code is a rule check. Use both. A policy that says "this agent can never call the delete tool on production" does not depend on anyone being awake.
Write down the exceptions
Some actions will not fit the table. Allow them case by case, with a note: who decided, why, and when to review it. A dated note makes the next review easy and keeps the rule from drifting.
Check the flow on a phone
If approvals arrive on phones, apply the checks in approving AI agent actions from your phone. Keep a rule that high impact actions need a full screen.
Review your table regularly
Look at the log of calls each month. Which actions were asked most often? Which approvals were always granted in a second? The always-approved ones may belong in Allow, and the never-approved ones may belong in Block.
Quick check
Should every tool call require approval?
No. Constant prompts cause approval fatigue and make real approvals meaningless. Ask for high impact, irreversible or outward facing actions, and allow the rest with logging.
Is an approval prompt enough to stop prompt injection?
It is one layer. Narrow tools, least privilege, authorization outside the model and monitoring all matter too, as OWASP's mitigations for excessive agency describe.
Sources
Last reviewed: 19 October 2026.
