For high-stakes operations — code that modifies production databases, deploys infrastructure changes, sends external communications, or touches sensitive data — requiring a human to review and approve the generated code before execution is the most reliable control available.

This is the confirmation step that autonomous agents typically eliminate. Adding it back for destructive or high-impact operations is not a failure of automation — it's appropriate risk management. A one-second human review of a DELETE statement before it runs against production is negligible friction compared to the cost of recovering from unintended deletion.

Implementation: The agent generates the code and presents it to the user with a clear explanation of what it will do. The user explicitly approves execution. This is the pattern used by Claude's computer use tools and by responsibly designed coding assistants.

For agents operating at too high a volume for human review of every code execution, automated static analysis can catch the most dangerous patterns before they run:

Dangerous function detection: Flag code containing os.system, subprocess, eval, exec, socket, requests, urllib, shutil.rmtree, or similar high-risk calls for additional scrutiny before execution.

Scope analysis: Detect file path operations that traverse outside the expected working directory. Flag any path that references ~, /etc, /var, or .. traversals.

Network destination checking: Before allowing any outbound connection, resolve the destination and verify it against the allowlist. Reject connections to unexpected external endpoints even before the network layer would block them.