When to require explicit human confirmation before an agent action

Flashcard·Easy·4.0 · 0·~30s·Asked atCapgemini Comet Ml Flowise

Attempt it

Draw the line on reversibility and blast radius. Search and add to cart are reversible and cost nothing,the agent can do them autonomously. Submit-order is irreversible: it charges money and ships physical goods. Require explicit user confirmation (with the cart summary surfaced) before dispatch. The rule generalises: any tool whose effect cannot be undone by the same agent in a later turn must pass through a confirmation gate. Compare with destructive ops like delete-account or wire-transfer, which need confirmation even for the agent's developer.

Your answer

**The line to draw is reversibility, not perceived risk.** An agent should be allowed to fire any tool whose effects it can undo on a later turn. Anything else needs a human in the loop confirmation step. For a shopping agent the split is concrete: - Search products,reversible, costs nothing, runs autonomously. - Add to cart,reversible, removing the item undoes the action. Autonomous. - Submit order,irreversible. Charges the card, dispatches goods. Requires a confirmation gate. The gate is not a yes or no prompt thrown blindly at the user. It surfaces the full payload,what is being bought, total cost, shipping address,so the human can verify before approving. After approval, the agent fires the tool. The rule generalises across every agent. Send-email needs a gate because once the message lands in someone's inbox, it cannot be recalled. Delete-file needs a gate because the bytes are gone. Wire-transfer needs the strongest gate because the money is on its way to another bank. Compare with read-file, list-tickets, or query-database: all reversible (they change nothing), all autonomous. Getting this taxonomy right early is the cheapest way to keep an agent both useful and safe.

**Gate on reversibility and blast radius,the two axes that actually matter.** Reversibility asks: can the agent undo this on a later turn without external help? Blast radius asks: who is affected if the action is wrong? For the shopping agent: - `search_products` and `add_to_cart` are reversible at zero cost; the next agent turn can remove the item. No gate. - `submit_order` is irreversible,money moves, goods ship, the merchant's fulfillment system commits. Mandatory confirmation gate showing the full cart, total, shipping address, and payment method. The gate is a structured payload presented to the user (not a generic 'are you sure?'), so the user can spot a wrong address or surprise charge before approving. The same rule maps onto every other agent surface. Reversible and low blast radius: any read, any draft, any in-memory state mutation. No gate. Irreversible or high blast radius: payments, external sends (email, SMS, slack), deletes, ACL changes, anything that touches another human or another system. Mandatory gate. For developer-tier actions,wipe prod database, deploy to prod,the gate is not just user confirmation; it is a separate identity (the developer, with their own MFA), because the user themselves should never authorise those. The cost to budget: too many gates and the agent feels useless; too few and one bad turn ships a refrigerator to the wrong continent. Calibrate by listing every tool, marking each undo-able or not, and only the not undo able ones get gates.

TL;DR

Gate an action on human confirmation when it is irreversible by the agent itself in a later turn,money moves, data deletes, messages send, physical goods ship.

Memory aid

Easy to grasp

Think of an assistant helping you online. If they put a book in your cart, you can take it out a second later,no harm done. But if they hit the buy button, the order ships, the card is charged, the box is on a truck. There is no undo. So you tell the assistant: anything you can fix yourself, just do it. Anything that involves real money, real shipping, or real damage if it goes wrong, stop and ask me first with a clear summary of what you are about to do. The rule is not about how risky the action sounds; it is about whether you, or the assistant, can put things back the way they were if it turns out to be a mistake.

Key concepts

Safety and guardrails Agents

Concept explanation~2 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

Confirmation gates are the bridge between an agent that is useful and an agent that is dangerous. Without gates, every tool the agent has access to is a tool it can fire blindly under any prompt,including a prompt smuggled in from an indirect-injection vector. With gates everywhere, the agent grinds to a halt and the user starts clicking through prompts without reading.

The interview question is checking whether you have a principled axis for deciding which actions need a gate. The answer is reversibility: can the next agent turn put things back the way they were, without external help? If yes, no gate. If no, mandatory gate with a structured payload preview. Blast radius is the secondary axis that decides whether user confirmation suffices or whether a developer-tier identity must approve.

The reversibility axis and why it is the right one

Reversibility is a property of the tool, not of how dangerous the action sounds. Search-products feels harmless and is reversible (changes nothing). Send-email feels routine and is irreversible (the message lands in the recipient's inbox and cannot be recalled). Delete-file feels destructive and is irreversible. Wire-transfer feels obviously dangerous and is irreversible.

The failure mode of gating on feeling rather than reversibility is double-sided. On one side the agent over-confirms: the user is asked to approve a search, a list, a get-status,generating consent fatigue, and the user learns to click through. On the other side the agent under-confirms: send-email looks like a chat message, fires without a gate, the wrong customer gets a confidential thread, and the breach makes the news.

The operational rule is simple: list every tool in the registry, mark each as reversible or irreversible, and the irreversible ones get gates. Reversibility here means 'the same agent, on its next turn, with no external action, can put the world back the way it was.' Calling search again and discarding the result is reversibility. Sending an email and then sending a retraction is not,the original landed; the retraction is a separate, observable event.

Blast radius and the user vs developer tiers

Where the gate lives,runtime vs prompt

The structured payload preview and consent fatigue

Situations where this technique stops working.

2–4 min · Everything important, quickly.

Real products, models, and research that use this idea.

Anthropic's Computer Use mode in Claude Opus 4.7 surfaces a confirmation banner for tool calls that would close apps, send messages, or modify files outside a scratch directory.
OpenAI's Agents SDK in 2026 supports per-tool `requires_approval` metadata; gated tools pause execution until the calling app emits an `approval` event.

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you design the confirmation gate so that prompt injection cannot trick the agent into self-approving?

Move the gate out of the model's reach: the runtime intercepts the tool call, suspends execution, and surfaces a payload to a UI the user controls. The model never sees an 'approval' token; the runtime emits one only when the human clicks. Treat the model as untrusted by default.

2 more follow-ups an interviewer would ask next. Sign in to reveal them.

Red flags & common mistakes

The phrases that signal junior thinking. Click to expand.

Most common mistake

Gating on perceived danger instead of reversibility. A read-only call can feel scary; sending an email feels routine but is irreversible. The axis is undo, not vibe.

60 second bullets to scan on the way to the call.

Reversibility as the primary axis for deciding which tools need a gate
Blast radius as the secondary axis for distinguishing user-gated from developer-gated actions

Primary sources. Browse if you want the original framing.