AI Agent Guardrails: What to Approve, What to Block, What to Log

Sort every action your agent can take into three buckets — auto-run, ask first, never — and the guardrail problem is solved. Most operators skip the sort and end up with one of two failures: an agent that asks about everything, or an agent that asks about nothing. Both are the same mistake. Nobody decided what the agent was allowed to do.

Why the approve-everything setup fails

The default in most agent tools is a permission prompt before each action. It feels safe. It isn’t, past a certain volume.

Anthropic published the numbers on this in 2026 for Claude Code: users approve 93% of permission prompts. In a study of 1,053 paid testers, people caught 13.6% of deliberately dangerous commands when clicking through prompts manually — an automated classifier caught 89% (source).

Read that carefully, because it isn’t an argument for removing oversight. It’s an argument against undifferentiated oversight. A prompt you approve nine times out of ten has stopped being a decision and become a keystroke. Attention is finite; spend it on the actions that can actually hurt you.

The three buckets

Write your agent’s action list on one page and sort it. Every action goes in exactly one bucket.

Auto-run — reversible, cheap, internal, and observable in a log. Drafting. Summarizing. Reading files. Classifying. Tagging. Writing to a scratch doc. If the worst case is “delete the output and rerun it,” it does not need you.

Ask first — anything that leaves the building or costs money. Sending email. Posting publicly. Replying to a customer. Spending against a card. Writing to the CRM of record. Anything a client, a regulator, or an inbox will see. These are the ones your attention is for.

Never — no prompt, no exception, configured out at the tool level. Deleting data. Changing permissions or billing. Touching production. Moving money. Anything you would not delegate to a competent new hire in their first week, because that is roughly the trust level you have earned with this agent so far.

The bucket is a property of the action, not of the agent’s confidence. An agent that is sure about a refund still doesn’t issue one.

Make the “ask first” prompt worth reading

A prompt that says “Approve?” trains you to click yes. A prompt worth stopping for shows four things:

1. The action, stated plainly — who receives what.
2. The reason, with the source it came from.
3. The blast radius — one recipient or four hundred, $12 or $1,200.
4. The undo — is there one, and who performs it.

If your tool can’t render that, put it in the message the agent sends you. A Slack approval card with the draft, the recipient count, and a reason line takes ten minutes to build and converts approval from a reflex back into a decision.

Where the tools sit today

The good news: approval gates have become table stakes rather than a feature you engineer.

• Le Chat — Work Mode runs multi-step jobs across connected mail and calendar and requires explicit approval before sensitive actions execute. The gate is the default, not a setting you find later.
• Lindy — owns a role rather than a sequence, which makes the approval config load-bearing. Set it before you let it send anything.
• Make — AI Agents run on all plans and spend credits per module call, so an unleashed agent has a cost failure mode as well as a trust one. Cap the scenario, then watch the credit line.
• n8n — self-hosted, so the strongest guardrail is the one you already have: the agent only reaches what the host can reach. Scope credentials to the workflow, not to the account.

Different tools, one pattern. The vendors converged on human approval for outbound and irreversible actions because that is where the damage lives.

The weekly review is the actual guardrail

Buckets decide what happens in the moment. The log decides whether your buckets were right.

Once a week, ten minutes:

• Read the auto-run log. Anything in there that made you flinch moves up to “ask first.”
• Count your approvals. If you approved 40 of 40, that bucket is miscategorized — those actions are routine and belong in auto-run, where they’ll be logged instead of rubber-stamped.
• Check the denials. If you never deny anything, you are not supervising. You’re witnessing.

Promotion runs both ways, and both directions are progress. An action earns auto-run after a few clean weeks. An action gets demoted the first time it surprises you.

The one-page version

• Sort every action into auto-run, ask first, never — before the agent goes live.
• Bucket by consequence, never by how confident the agent sounds.
• Outbound and irreversible always require a human.
• A prompt without action, reason, blast radius, and undo is a keystroke, not a decision.
• Review the log weekly and move actions between buckets. Zero denials means the review isn’t real.

Give the agent a leash. Then check, every week, that the leash is the right length — because the point was never to stop the agent from working. It was to stay the one deciding what the work is.