Sort actions by reversibility
- Reversible (rename, move, draft) — run immediately, show undo.
- Hard to reverse (send email, post message) — confirm with preview.
- Irreversible (delete, pay, publish) — confirm with explicit type-to-confirm.
Explain in one sentence
Before the irreversible step, the model should say what it's about to do in concrete terms. "I'm about to delete 14 archived projects you haven't opened in 90 days." Not "performing cleanup."
Dry-run first
Every mutating tool should support a dry-run flag that returns what would change without changing it. Hosts can use this to render a diff before asking for confirmation.
Audit > consent
Confirmation is for the user. Audit is for everyone else. Log every action with input hash, output hash, and outcome — that's how trust survives an incident.
FAQ
- Confirm every action?
- No. Confirm destructive and irreversible ones. Confirmation fatigue is real — if every action prompts, users blind-click through the dangerous ones.
- How granular should consent be?
- Per tool family at install; per action at runtime for high-blast-radius work (delete, send, pay).
- Should the model explain itself?
- Yes, in one sentence. "I'm about to delete 14 archived projects you haven't opened in 90 days" is trust. "Performing cleanup" is not.