One important problem in agentic AI is deciding when an agent should execute a tool call automatically and when it should request human approval.
A system that requires confirmation for everything can become unusable.
But a system that executes consequential actions without adequate authorization can be dangerous.
How should developers approach this trade-off?
- Separate Planning From Execution
An AI agent might generate a valid plan without being authorized to execute every step.
For example:
Read a calendar.
Identify scheduling conflicts.
Propose a new meeting time.
Cancel an existing event.
Send notifications to attendees.
The first three steps may be relatively low-risk in an authorized context.
The final two modify external state and affect other people.
The system should evaluate execution permissions before performing these operations.
- Add an Approval Gate
A simplified architecture might look like this:
User Request → Planner → Tool Selection → Policy Check → Execution → Verification
The policy check can evaluate:
Whether the requested operation is authorized
The potential impact of the action
Whether the action is reversible
Whether required parameters are present
Whether explicit confirmation is necessary
The policy engine should not rely solely on an LLM's judgment for security-critical decisions.
- Example: A Simple Approval Policy
The following pseudocode illustrates the idea:
def should_request_approval(action, permissions):
if not permissions.allows(action):
return "DENY"
if action.is_high_impact:
return "ASK_USER"
if action.has_external_side_effects:
return "CHECK_POLICY"
return "EXECUTE"
This is illustrative pseudocode, not production-ready access-control logic.
Real systems need to consider tool-specific permissions, authentication, approval expiration, auditability, and race conditions.
- Approval Is Not the End of the Workflow
Even after the user approves an operation, execution can still fail.
The API might time out.
The parameters could be incorrect.
A retry could unintentionally duplicate an action.
That's why approval mechanisms should be combined with execution monitoring, safe retry handling, and outcome verification.
- What We're Exploring at HEELO
At HEELO, we're developing an execution layer for AI agents.
Our work includes tool integration, multi-step workflows, and reliability testing.
As agents gain the ability to act across external systems, handling authorization and user control becomes an important design consideration.
Reliable agents need to know not only how to execute an action, but whether they should execute it.
HEELO — From Talking to Doing.
Project: https://heelo.dev
Discussion
How do you handle approval requirements in your AI agent architecture?
Do you use tool-level permissions, risk-based policies, explicit user confirmation, or a combination of these approaches?
Top comments (0)