Topic
A design pattern in AI agent systems requiring human sign-off before irreversible actions like deletions, payments, or permission changes.
MaxKB's v2.10.5-lts fix for a CVSS 10.0 agent flaw repairs shell quoting but leaves the execute tool off the approval list. According to one developer's trace of the release tag, a prompt planted in ingested documents can still trigger shell commands with no human sign-off.
Reality
Anduril marketing chief Jeff Miller gave AI agents access to his bank details and email, then used them to clear six months of expense reports. The approval he keeps for himself covers what an agent sends or buys, so a team policy modelled on it still has to decide what the agent may read.
Reality
A dev.to post says the 2026-07-28 specification dropped the initialize flow and Mcp-Session-Id, so MCP requests can land on any instance. The refund agent it walks through still breaks on the second pod.
Reality
Across 34 runs on three agent frameworks, a recorder proxy shows that what the dedup key names decides whether a retried publish executes once or twice, and that surviving a SIGKILL is a separate question about where state is kept.
Reality
Part 4 of a dev.to enterprise AI series puts a person in front of the write and send connectors and leaves read paths alone, with the refusal enforced by the tool layer instead of a sentence in the prompt.
Reality
An R0-R5 tiering in the open-source KeelBase server lets the declared level decide whether an agent's call executes, waits for a person, or is refused, and a tool that declares nothing has its writes held at confirmation.
Reality
Part 14 of a dev.to series describes what its author calls "a support agent that can work out whether you're owed a refund, and cannot give you one", with the eligibility rules pinned to the JDK by a test.
Reality
A dev.to walkthrough swaps the agent spinner for a typed state machine covering planning, approval, retry and blocked, and its reducer reads only the newest event, so the server has to name each state first.
Reality
capbroker hands the agent a signed, expiring ticket and evaluates every call in deterministic code. In the second run the injected instruction stayed inside the granted scope, and a human at the terminal was what stopped it.
Reality
His case rests on a refund workflow where anything over $100 needs human confirmation, a rule that stays an instruction while it lives in the prompt and becomes enforceable only when something inspects the tool call first.
Reality
Anthropic's 37-skill beta reads only what a user's Salesforce permissions allow and writes back only after that seller approves each change. The approval is a default setting. Revenue teams now have to govern it.
Reality
The journal chains each record's hash into the next, so a one-line edit to a refusal surfaced as a numbered record; anyone able to rerun the writer can still recompute the chain and pass the check.
Reality
The Run SDK swaps eval's ambient authority for a worker-thread sandbox with narrow host functions and resumable interrupts. The replay semantics are the part to read twice.
Reality
In MCP's Sampling flow the server composes the prompt and the client runs the completion on its own model. The includeContext default is "none", and the two wider values only work if the client declares a capability.
Reality
A quality engineer writing on dev.to argues that ISO 13485, EU MDR and FDA guidance all assume an accountable human without listing the approvals an AI may not make, so each site has to write that list itself.
Reality
Tenable's account of the control layer around Hexa AI lists what broke during development, including an agent that did not know who was asking, a model that denied tags it could not find, and queries that died past 5,000 assets.
Reality
The write-up names three ways attacker-controlled text can reshape what an approval prompt shows, and cites one Checkmarx demonstration against Claude Code. It carries no measure of how often a doctored dialog actually fools a human.
Reality
Hossein Hezami's ladder runs observe to destroy and gives sensitive reads a class of their own. The interesting part is the TypeScript, where risk arrives as a field on the request and someone other than the model has to set it.
Reality
Max Brin's authorization layer runs alongside AI agents for several hundred personal users and at least four organizations. The pattern worth noting is enforcement at the outbound action rather than inside the model.
Reality
A dev.to design note inserts code gates and a human approval between the model and the tool, which is the right shape, though a policy layer that reads a severity field the model itself wrote has not moved the authority anywhere.
Reality
Build · August 24, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 22, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Product · August 20, 2026 · 1 publisher
Build · August 16, 2026 · 1 publisher
Build · August 16, 2026 · 1 publisher
Build · August 14, 2026 · 1 publisher