Classify tool calls by impact level before deployment. Read operations (query, search, summarize) → auto-approve. Write operations (update, create) → require logging and audit trail. Destructive or high-impact operations (delete, send, publish, transfer, pay) → require explicit human confirmation or policy engine approval.
Before high-impact actions execute, show the user a dry-run preview: "I'm about to issue a refund of $4,200 to order #8821. Confirm?" This forces intent verification at the moment of action.
Approval gates are only as good as what they show. If the dry-run shows a sanitized summary and the actual action has different parameters, the approval is false assurance. The confirmation UI must show the exact payload the tool will receive — not a summary the agent generated.
Too many approval gates and users start clicking "Confirm" automatically without reading. Gate only what's genuinely high-impact. A useful heuristic: if the action can't be undone in 5 minutes, gate it.
S02 (Indirect injection → tool pivot), S03 (Over-Privileged API refunds), S07 (Mass database delete). A human seeing "I'm about to delete 14,000 records" stops the misalignment incident cold.
Ask your team: when your AI agent takes a high-stakes action — sending an email, modifying a record, making a payment — does a human have to confirm it first, or does it happen automatically? Ask whether there is a preview step that shows exactly what will happen before it happens.