A human in the loop

Approval gates

Split tools by risk. Read-only tools (search, read a file, check the weather) run straight away. Risky ones (send email, pay, delete) pause and ask a person.

Anything not on either list is blocked: an agent should never be able to call a tool nobody reviewed.

Exercise: The approval gate

Read-only tools: search, read_file, get_weather. Risky: send_email, pay, delete_file.

Input: n, then n tool calls name argument, then the answers (y/n) for the risky calls, in order (there may be none).

Print ran <name> for read-only tools; asked about <name> <argument>: approved, ran or : denied, skipped for risky ones; blocked <name>: not an allowed tool otherwise.