Agents need human confirmation for consequential actions

Asking for human confirmation on every action causes prompt fatigue: users click yes to everything, which defeats the purpose. The better pattern is a policy engine that evaluates risk dynamically. An action that is read-only or low-cost proceeds automatically. An action that is irreversible, involves money, or follows exposure to untrusted content requires explicit confirmation.

OpenCode implements this as a per-tool permission config where each rule resolves to allow, ask, or deny. The read-only or safe calls run; destructive ones (an rm *, an edit outside the project) hit an approval prompt with once, always, or reject. Cline reaches the same goal with a coarser Plan versus Act mode toggle. Both encode least privilege: grant the minimum capability for the task and escalate to a human for high-stakes operations.

The policy engine should also track data flow: if an agent (see: agent actions and planning must be observable) recently processed content from an untrusted source, subsequent write actions should require confirmation regardless of their normal risk level.