What you will learn
Approvals, Least privilege, Sandboxing, Audit records, Prompt injection.
Engineering the capability
Human approval is meaningful only when the person can inspect what will happen. Store the target resource, proposed change, resource version, requester, expiry, and operation ID. The server verifies the approver’s authority and binds approval to those exact values.
Changing a proposal invalidates its approval. Recheck permissions and resource version at execution time. A user may have lost access or the target may have changed while waiting. A conversational “yes” without a clear proposal can be ambiguous and should not authorize arbitrary actions.
Limit tools even when approval exists. A sandbox constrains possible effects; an audit record explains what happened. Do not depend on the model to obey a restriction that can be enforced by an API scope or application permission. Keep sensitive contents out of broad operational logs.
Worked case
A reviewer approves a reply to ticket 42. The agent then changes the recipient to ticket 84. Approval must not carry over because the target changed. Compare a stored proposal hash or immutable proposal record, then authorize the actual target again before execution.
Put it into practice
Continue with the next lab: test an approval state machine. Build the artifact, record the failure cases, and explain the tradeoff before moving on.