Guide · Approval gates

How do I require human approval before an AI agent runs a risky command?

Updated 2026-10-31

Put a gate between the agent and its tools that checks each call before it runs, holds the risky ones until a person approves that exact call, and records every decision. With kosa8, the Claude Code kit checks every Bash, Write and Edit call: a force push, a package publish or a git reset --hard waits in kosa8 mcp asks until you run kosa8 mcp approve ID, and MCP policy rules with the effect ask hold any tool call you choose by its arguments.

01Steps

Install kosa8 on an Apple silicon Mac or x86-64 Linux.
Run the agent under kosa8. The claude kit starts Claude Code in its own microVM, and its pre-run hook checks every tool call before it runs.
Approve or refuse held calls. A risky call is held and the agent is told it is waiting. In another terminal:
terminal
```
kosa8 mcp asks
9c41e07b2d5a6f18  pending  sandbox:claude-44059/Bash  by (unidentified agent)
    why:  K8-A001: rewrites or deletes history on a remote, which a rewind here cannot undo
    args: {"command":"git push --force origin main"}
    until 14:32:10
kosa8 mcp approve 9c41e07b2d5a6f18
```
The agent repeats the call and it runs once; kosa8 mcp refuse ID says no. An approval is bound to the agent, the tool and a SHA-256 digest of the arguments, is good for one use within ten minutes, and must be given by a person at a terminal.
Add ask rules for your own tools. For tools served through kosa8's MCP gateway, rules look at each call's arguments and answer allow, deny or ask. This server entry (an example; use your own server and tool names) holds every deploy and any payment over 1000:
part of policy.json
```
{ "server": "ops",
  "rules": [
    { "id": "deploys-need-a-person",
      "tools": ["deploy_*"],
      "effect": "ask",
      "reason": "deploys are reviewed" },
    { "id": "large-payments-need-a-person",
      "tools": ["create_payment"],
      "when": [ { "arg": "/amount", "op": "gt", "value": 1000 } ],
      "effect": "ask",
      "reason": "amounts over 1000 need finance" }
  ] }
```
If the agent sends "amount": "5000" as a string, the condition cannot be evaluated and the rule fires anyway, so quotation marks do not get past a limit. Set "rules_mode": "log" to test rules without blocking anyone.
Test, sign and install the policy. check applies the rules as the gateway would and exits non-zero for a deny or an ask, so it can run in CI. The signing key comes from kosa8 policy keygen.

A running gateway reads the policy when it starts, so restart kosa8 mcp serve afterwards.
Gate kosa8's own actions. kosa8 approve governs what kosa8's assistant (kosa8 ai) may do. Read-only actions run unprompted, work inside an existing sandbox asks once per session, and destructive actions or anything that widens the sandbox boundary ask every time and cannot be auto-approved.

kosa8 approve deny KIND refuses a kind outright. When an organisation policy lists approvers, an escalating action needs approvals signed by named people: kosa8 approve request, then kosa8 approve sign by someone else (you cannot approve your own request), then kosa8 approve status ID --record.
Read the record. Every decision lands in the hash-chained audit log at ~/.kosa8/audit.jsonl; tool arguments are stored as SHA-256 digests, not in full.

02Which AI agent commands should need a person's approval?

Anything that cannot be undone from inside the sandbox or that reaches outside it: deleting .git or the workspace, git reset --hard and git clean -fdx; deploys and cloud or cluster destroys; payments and other spending; and external writes such as force pushes, package publishes, pull request merges, repository deletes and API DELETE calls. Reading credentials and destructive SQL belong on the list too.

The claude kit's built-in rules map onto that list. A shell command is parsed rather than pattern-matched, so bash -c 'git push -f' and git -C repo push -f count as the same force push.

Asks you: K8-A001 force push or remote delete · A002 cloud or cluster destroy · A003 publishing a package or image · A004 PR merge, repo delete, API DELETE · A005 reading credentials or the whole environment · A006 destructive SQL · A007 git reset --hard, git clean -fdx, deleting .git or the workspace · A008 code piped into an interpreter from something the rules cannot read.
Refused outright: K8-D001 a download run as code (curl … | sh) · D002 a write to the agent's own settings or hooks · D003 credential files sent off the machine.
Runs, but marked: network tools, package installs, git push, sudo.

Ordinary deletes inside the sandbox are not held, because a rewind can undo them. Deploys and payments usually arrive as tool calls, which the ask rules in step 4 cover.

03How often do kosa8's built-in rules catch a risky call?

Measured against a hand-labelled set of tool calls, the built-in rules stop 66 of 75 risky calls (88.0%) and 1 of 89 ordinary calls (1.1%). The misses include make targets, script files, aliases, programs held in a variable and code inside Python or Node one-liners, because a rule cannot see inside a file or a language it does not parse.

The test set is pkg/rules/testdata/corpus.jsonl in the kosa8 source, and the build fails if either rate gets worse.

04Is an approval prompt enough on its own?

No. People who are asked too often approve by reflex, and a rule reads only the call it is given. kosa8 pairs the gate with a sandbox that bounds what any call can reach, an audit log that records every call the model asked for whether or not a rule caught it, and checkpoints that undo what happened inside the sandbox.

Requiring a terminal stops an agent approving its own call through a pipe; for anything stronger, use signed approvals from named people.

05Other options

Claude Code permission rules. Claude Code's settings take allow, ask and deny lists of rules such as Bash(git push:*). This fits a single developer who wants prompts inside the tool they already use.
Claude Code hooks. A PreToolUse hook runs your own script before a tool call and can allow it, block it or ask the user, so you can write checks of any shape.
Your agent framework's human-in-the-loop features. LangGraph's interrupt pauses a graph until a person responds, and the OpenAI Agents SDK documents approval of tool calls. These fit when you write the agent yourself and want the approval step inside its own flow.

kosa8's gate sits outside the agent's machine, and the approaches can be combined.

06Sources

Related guides

Updated 2026-10-31