Approvals, confinement, and memory
Constrain plans and execution with approvals, budgets, isolation, memory boundaries, and deterministic policy checks.
Approval is a bounded authorization
An approval should show the proposed action, exact target, material arguments, expected side effects, data exposure, cost or resource impact, alternatives, uncertainty, expiry, and approver authority. Approval of a plan is not approval of materially changed execution.
Confinement
Limit tool set, network destinations, file and secret access, execution identity, environment, runtime, steps, tokens, time, spend, concurrency, and affected resources. Use isolated workspaces and deterministic enforcement outside the model.
Define stop conditions for policy denial, budget exhaustion, repeated failure, unexpected target state, conflicting instructions, missing evidence, and human cancellation.
Memory
Separate run-local working state, user preferences, approved durable memory, external knowledge, and authoritative records. Define what may be written, read, shared, corrected, expired, exported, or deleted. Treat memory content as untrusted input and preserve source and permission metadata.
Human control
Make approval interfaces resistant to fatigue and misleading summaries. High-impact decisions should expose decisive details and changes since review. Emergency override needs narrow scope, expiry, monitoring, and independent follow-up.