Which actions should an agent be allowed to take without asking, and how do you draw that line?

There is a principle and it is not "how risky is this". It is reversibility.

Sort every action the agent can take into three buckets:

• Reversible and cheap. Reading, searching, writing to a scratch branch, producing a draft. No approval, ever. Interrupting here is pure cost.
• Reversible with effort. Committing to a branch, creating a resource, sending an internal message. No approval, but it must be logged and undoable, and somebody must be able to see what happened without asking the agent.
• Irreversible or externally visible. Sending mail to a customer, deleting data, deploying, paying, posting publicly. Always approval.

The reason this beats a risk score is that risk is a judgement and reversibility is a fact. You can answer it for each tool once, at design time, and the answer does not drift.

It also tells you what to build: the middle bucket needs an undo, and building the undo is usually cheaper than building the approval flow.

Worth adding a category the reversibility test handles neatly but people forget to put in it: actions visible to third parties.

Sending a message, opening a support ticket with a vendor, posting a comment, filing something. Technically reversible — you can delete it — and the other person has already seen it. Treat those as irreversible, because in the way that matters they are.

That single addition catches most of the embarrassing failures I have heard about.

The second half is that approval fatigue is a security failure, not a UX complaint.

If your agent asks twenty times an hour, people stop reading the prompts within two days and start approving reflexively. At that point the approval step is worse than nothing, because it creates a record suggesting a human considered each action.

So the design constraint is a budget: how many approvals per hour will a person actually read? In my experience it is small — single digits. Anything above that and you are building a rubber stamp.

Which means the work is mostly in reducing the number of approvals, not designing the dialog. Batching several actions into one reviewable plan, approving a scope rather than a step, and moving actions into the reversible bucket by giving them an undo, are all better than a better prompt.

One pattern that has worked well for me and is worth stealing: approve the plan, not the steps.

The agent produces a plan — here is what I intend to do, in order, with the specific arguments. A person reads it once and approves. The agent then executes without interruption, and stops if reality diverges from the plan in a way that would require an action outside what was approved.

That gives you one meaningful review instead of fifteen meaningless ones, and the review happens at the point where a human can actually add something, which is before anything has been done.

The key detail is the divergence check. Without it you have approved a plan and authorised something else.