Patterns / Agent harness

Approval gate for irreversible actions

Let the agent draft anything it likes, but require a human yes before it sends, deletes, pays or publishes.

The problem

Most agent mistakes are cheap if they stay local: a bad file can be reverted. Some actions cannot be undone: sending an email, deleting data, running a migration, spending money, publishing something. A prompt that says "be careful" is not a control.

The pattern

Classify actions by reversibility and enforce the gate in the harness, not only in the prompt:

• Free: read, search, edit local files, run tests in a sandbox.
• Gated: anything external, destructive or costly. The agent prepares the exact action (full message text, exact command, exact record IDs) and stops. A human approves that exact action.

Enforce it with tool permissions where your tooling supports it (allowlists, confirmation prompts, read-only credentials, dry-run flags). The prompt then explains the rule so the agent plans around it instead of hitting it by surprise.

Template

## Action rules

You may do these without asking:
- Read any file in the repo; search; run tests and linters.
- Create or edit files inside <working dir>.

You must STOP and ask for approval before:
- Sending any message (email, chat, comment, PR, issue).
- Deleting files or data you did not create in this session.
- Running migrations, deploys, or any command against non-local systems.
- Installing packages, or anything that costs money.

When you need approval, output:
APPROVAL NEEDED
Action: <exact command / exact message incl. recipient / exact records>
Why: <one sentence>
Reversible: yes/no — <how to undo, if yes>
Then wait. Do not proceed on partial or implied approval.

When not to use it

• Inside a disposable sandbox where nothing touches the outside world. There, a gate mainly slows you down.
• Do not rely on the prompt alone for anything truly dangerous. If a mistake would be serious, remove the capability (credentials, network) rather than asking nicely.