What decides whether an AI agent just acts, pauses to ask you first, or refuses outright?
How does auto-review decide between proceeding, asking approval, or blocking an action?
This explores how an automated reviewer inside an AI agent decides whether an action can go ahead on its own, needs a human to approve it, or should be stopped, and what the research says about making that three-way call well.
This explores how an AI agent's built-in reviewer sorts actions into three groups: go ahead, ask the human first, or stop. The collection has only one source that describes a real auto-review system, and it doesn't spell out the decision rules in detail. OpenAI's dots agent layers its controls. Its background research runs only with read-only tools, so most risky actions aren't available in the first place. An auto-review step then checks the remaining actions against what the user meant to do and against safety requirements. Some kinds of action, such as password changes and anything that affects the user's account, always need explicit user approval Can read-only tools and approval rules prevent autonomous agent failures?. So the answer is partly that the decision is made ahead of time, by the kind of action, and only partly made in the moment.
That split between taking an action off the table and asking an agent to choose not to take it matters more than it seems. One study bundled clear permission rules together with restricted tools and found that no protected tests were modified. But it couldn't say which of the two did the work. In the same pipeline, agents skipped the judgment step 100% of the time and still took no unsafe actions Do authorization rules or restricted tools prevent test modifications?. That suggests the restrictions did the protecting, not the agent's judgment. For auto-review, the takeaway is that blocking an action by making it impossible may be more reliable than counting on a reviewer to say no.
For the ask-a-human route, the strongest evidence favors sending only the uncertain, high-stakes decisions to people. AutoResearchClaw passed control to a human when its confidence was low and reached an 87.5% accept rate. Full autonomy reached 25%, and step-by-step human review reached 50%, partly because people asked to approve everything start approving without really looking Does targeted human oversight beat both full autonomy and exhaustive review?. A good auto-reviewer, then, isn't trying to send as many decisions to humans as possible. It's trying to keep their attention for the decisions that matter.
The part you might not expect: judging one action at a time has a built-in blind spot. A sequence of actions that are each allowed can still add up to a violation, so safety depends on the agent's whole path, not on any single step Can step-by-step approval miss harmful behavior patterns?. The numbers make it worse. One agent can make thousands of tool calls while a person reviews a handful How much agent behavior actually gets human review?. And the reviewer can be fooled. In a four-agent system with permission checks turned off, a validator that read poisoned shared memory approved unsafe actions in every trial, because it judged them using corrupted evidence Can a poisoned validator still approve unsafe actions?.
The collection doesn't explain how any system draws the exact line between asking for approval and blocking outright, or how its intent checks are scored. What it does suggest is a design pattern. Remove dangerous capabilities up front, always require approval for certain action types, send uncertain cases to humans, and watch patterns over time, because a reviewer that only checks single actions can miss them or be tricked.
Sources 6 notes
OpenAI restricts dots' background proactive research to read-only tools, layering on custom rules and auto-review that checks actions against user intent and safety requirements. Password changes and account-affecting actions require explicit user approval.
The abstract bundles clear authorization rules with restricted tools and reports zero protected-test modifications, but no single-factor ablation distinguishes whether the result comes from unavailable crossings, unchosen crossings, or both. The pipeline's own data elsewhere (100% Judgment Bypass Rate with 0% Unsafe Action Rate) shows the distinction matters.
AutoResearchClaw's confidence-routed CoPilot mode achieved 87.5% accept rate, beating full autonomy (25%) and step-by-step oversight (50%). Selective human intervention on high-stakes decisions avoids both uncaught errors and the rubber-stamping fatigue of constant interruption.
Research shows sequences of individually permissible actions can collectively break system constraints. Safety rules bind entire behavioral envelopes, not just single steps, so checking actions one at a time fails to catch trajectory-level violations.
A single agent issues thousands of tool calls while human operators review a handful of decisions. This arithmetic mismatch means per-decision review sees only isolated actions, missing the sequences and trajectories that actually determine whether behavior violates system constraints.
Show all 6 sources
In a four-agent LangGraph system with authorization disabled, a validator that reads poisoned shared memory forges approvals in every trial, leading to execution of unsafe actions. The validator's position as final authority before action execution, combined with its access to corrupted evidence, made it ineffective as a boundary.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- The Oversight Fallacy: Why AI Agents Require More than Humans-in-the-Loop
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- AI Agents Push Humans Out of the Loop
- Towards a Science of AI Agent Reliability
- Trust propagation and structural containment in Multi-agent LLM pipelines
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
- Visibility into AI Agents
- Overseeing Agents Without Constant Oversight: Challenges and Opportunities