Skip to content

PATTERN Cited by 1 source

Human-gated tool invocation

Problem: Some tool calls are neither clearly within scope (safe to auto-allow) nor clearly out of scope (safe to auto-deny). They're sensitive for this context — the user probably wants them, but confirmation prevents damage if the call was injected.

Pattern: Introduce an ASK verdict between ALLOW and DENY. When the policy engine cannot confidently classify a tool call as in-scope or out-of-scope, it pauses execution and surfaces the pending action to a human for explicit approval before proceeding.

Shape

Tool call → Policy engine → ASK verdict
                              │
                              ▼
                   ┌─────────────────┐
                   │ Human approval  │
                   │ (approve/reject)│
                   └────────┬────────┘
                            │
              ┌─────────────┴─────────────┐
              ▼                           ▼
         Proceed                     Block action

Example

In a data-quality session, update_dashboard is the user's legitimate request but involves a write operation. The intent policy classifies it as ASK: pause, show the human what's about to happen, and proceed only on approval. Meanwhile grant_table_access (injected via data) gets DENY (hard block), and query_table gets ALLOW (no pause needed).

Design considerations

  • ASK must be synchronous and blocking — the agent cannot proceed with the gated action until approval arrives.
  • The approval surface must show the specific action and arguments, not just "the agent wants to do something."
  • Under deny-wins composition, if another policy DENYs the same call, the ASK is moot — denial takes precedence.

Seen in

Last updated · 593 distilled / 1,805 read