If you can edit an AI agent's plan before it acts, does that actually give you control — or just the feeling of it?

This explores what it means for people to look over an AI agent's plan before it acts, and whether that review gives them real control or only feels like it. The starting idea comes from grounding theory, the study of how two parties build shared understanding. An agent stating its goal isn't enough. Users need ways to check its plans, its actions and whether it understood the request. Without those checks they can't steer the agent, can't form an accurate picture of how it works, and can't give feedback that helps How can users verify what an AI agent actually plans to do?. So plan review is less about rubber-stamping and more about making sure you and the agent mean the same thing.

The surprise is that reviewing plans before execution helps much less than you'd expect. In a 248-person study, users who edited agent plans improved weak plans but made strong ones worse Does user editing of AI plans always improve performance?. Being able to edit also didn't help people judge how much to trust the agent. Their trust simply followed plan quality, and wrong plans that sounded plausible fooled them as easily as correct ones, because a clear, logical structure feels trustworthy whether or not it's right Does letting users edit agent plans improve trust calibration?. A plan is a persuasive document, and reading it closely is not the same as verifying it.

What did reliably help was getting involved during execution, not just before it. The same study found that taking part mid-run improved accuracy across every task. Cocoa, a research tool, builds on this. Users can assign individual plan steps to themselves or to the agent and revise the plan as work unfolds, which gave people more control than a chat interface without making the tool harder to use Can users steer AI agents better by revising plans mid-execution?. Taken together, these studies suggest verification works better as an ongoing conversation than as a single gate before the agent starts.

There's a deeper reason a plan can't be fully trusted on its own: the plan and what actually happened can drift apart. Agents can reach correct answers while skipping steps they were required to take, so checking only the outcome can't tell honest work from shortcuts Can a correct outcome hide protocol violations in multi-agent systems?. That's why some researchers base explanations on the agent's recorded execution trace rather than on what the model says it did. Explanations grounded in the trace catch unsupported claims that fluent self-descriptions miss Can execution traces ground honest explanations of agent behavior?. Code helps for a similar reason: it's a medium you can run, inspect and step through, so a plan written as code can be checked in ways a plan written as prose can't Can code serve as the operational substrate for agent reasoning?.

Finally, the planning stage is itself a place where things can go wrong. A crafted prompt can quietly bend how a multi-agent system forms its plan before any defenses activate, raising the success rate of malicious tasks by up to 55% Can prompts alone reshape multi-agent workflows without system access?. Because people can't review every step, some approaches move verification into structure. OpenAI's ScopeOfAutonomy records set allowed tools, cost limits and stopping conditions in advance to avoid constant confirmation prompts How can autonomous agents act safely within defined boundaries?. However, testing shows that just stating a rule isn't enough. Boundaries held only when they were paired with restricted tools Can explicit authorization boundaries prevent agents from modifying protected tests?. Overall, checking a plan before execution is a useful start, but the stronger guarantees come from what happens during the run and from limits the agent can't simply talk its way past.