Put the gate before the consequence
An assistant can prepare a reply without sending it. It can propose a record change without writing it. It can identify a possible exception without promising one to a customer.
Place the approval where the consequence begins. That gives the system useful preparatory work while keeping the decision with someone authorized to make it.
Show the reviewer enough to decide
A useful approval view shows the source, the proposed action and what will change. For an email, that means the recipient and exact text. For a record update, it means the current value and the replacement. For an exception, it means the rule and why this case fell outside it.
Avoid asking a person to approve a label such as “complete the task.” They need to see the task's actual effects. The approved action should be the action executed, with a fresh check if the underlying state changes.
Treat outside text as data
Documents, emails and websites can contain instructions that were never meant to govern your agent. A model reading that material should not gain new authority because the text tells it to.
Anthropic's guidance describes layered defenses for prompt injection, including separating untrusted content and limiting the effects of a compromised model output. No single prompt is a complete security boundary. Anthropic guardrail guidance, checked September 6, 2026.
The application needs to enforce permissions and validate actions outside the model. A polite instruction to “ask first” is useful context; it is not a substitute for an enforced gate.
Decide how silence behaves
If the reviewer does not answer, does the job wait, expire or return to a queue? Make that behavior explicit. Silence should not unexpectedly become permission.
Hermes documents approval modes and fail-closed timeout behavior, while also explaining that command approval rules are not a sandbox against adversarial code. Isolation and restricted access serve a different purpose. Hermes security documentation, checked September 6, 2026.
Test the handoff as part of the product
Try a missing source, an expired approval, a duplicate request and a changed record. Check whether the operator can understand the state and recover safely.
Record who handles each failure before the agent goes live. Our managed-agent service includes exception review and clear ownership for the workflows in scope.