Human in the loop
A design where the agent stops and asks before any step that cannot be taken back — sending, publishing, paying, deleting.
The line is drawn by reversibility, not by risk in the abstract. Reading a hundred files needs no permission; sending one email needs it, because no later step undoes a message that has arrived.
Asking well is half of it. A confirmation that arrives on every step trains the person to approve without reading, at which point the safeguard has become a formality — which is why the number of questions matters as much as their placement.
The other half is what the question contains. Approval given for one action does not extend to the next one like it, and a request that hides what will actually happen collects a signature rather than a decision.