Separate an agent's proposal from an approved action

Drafting an email, refund or database change does not authorize it. Store a proposed action, show its effect to the right person and bind approval to that exact content.

Preserve the boundary

The agent controls lab creates a synthetic email proposal.

from agent_cases import approval_case

result = approval_case()
assert result["proposal"]["status"] == "proposed"
assert result["approval"] is None
assert result["executed"] is False
assert result["proposal_is_authority"] is False
assert result["safe"] is True

No message is sent. The recipient uses .test, and the body is represented by a digest.

Make approval specific

The review screen should show action type, target, material content, cost/impact, evidence and expiry. Approval records authenticated actor, time and proposal digest. Any change to recipient, amount or body invalidates the approval and returns to proposed state.

Keep execution credentials outside model context and use least privilege. Retrieved text, a tool response or another agent cannot approve the action. High-impact classes may require two reviewers or remain manual.

Handle pending and failed execution

Persist state safely while waiting. Do not hold locks or repeatedly notify. After approval, execute once with an idempotency key and report a durable receipt. If execution fails, distinguish safe retry from uncertain outcome before trying again.

The Generative & Agentic AI course treats approval as a typed workflow state and auditable boundary.

Exercise

Build propose→pending→approved/rejected→executed states. Alter the amount after approval and prove execution refuses the stale digest. Retry an approved call twice and create one side effect.

Continue learning

This article is part of the Agent workflows and state sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Validate tool arguments before execution.
• Continue with Design typed state for a multi-step workflow.

Reference: NIST AI RMF playbook.