Asking first is a feature, not a limit

Some people see an approval as friction. We see it as the thing that lets you leave an agent running.

Trust is built on the stop#

You would not give a new colleague the keys to everything on day one. You would let them read, sort and draft, and ask you before they send or change anything. After a few weeks you would tell them what they can do alone. An agent that asks first lets you do the same, and the list of what it may do alone is the list of tools you marked safe.

Design agents that ask rarely#

The best agents rarely need to ask, because their job is mostly reading. A triage agent reads and drafts, and its drafts are text, not actions. A digest agent reads pages. A project reporter reads tasks. For those, nothing is risky and the inbox stays empty. Reserve the tools that write for agents whose job needs them, and expect those to ask.

Make the ask readable#

An approval says what the agent wants to do, which agent and since when. You decide faster when the agent's instructions tell it to explain what it is about to do and why before it calls a risky tool.

Do not mark your way around it#

Marking a tool read-only is a promise that it only reads. If you mark a write tool read-only because the questions annoy you, you have turned the gate off for it. Better to narrow what the agent can reach, or to have a person run that step.

Denials teach#

When you deny a call, the agent is told that it failed because you declined, and it can adapt. Over time you will see which asks are noise and which matter, and you can change the instructions or the tools accordingly. Every change is a version, so you can go back.

The result#

An agent you do not have to watch, because it stops where it should. That is the whole point of Agent host.

See approvals and the risk rule.