We Gave AI Agents Real Tools — Then Realized “Just Ask Before Acting” Wasn’t Enough

As AI agents gain the ability to interact with real-world tools—such as modifying databases, sending messages, or triggering workflows—the traditional safety approach of simply prompting the model to 'ask before acting' has proven insufficient. The author argues that relying on the model to determine its own authority creates a dangerous ambiguity, as AI may struggle to distinguish between routine tasks and high-impact actions. Instead, developers should implement a strict architectural separation: the AI proposes an action, but a deterministic system policy decides whether that action requires human approval based on its classification (Read, Write, or Destructive). By enforcing task-scoped permissions, audit trails, and 'fail-closed' security, developers can build more reliable agentic systems. Ultimately, the article emphasizes that as agent capabilities grow, permission management must transition from a prompt-based suggestion to a core, hard-coded component of the software architecture.