Action Confirmation
Some things an agent is about to do cannot be undone — a refund issued, a table dropped, a message sent to a customer. Action confirmation is the deliberate pause in front of those moves: the loop stops, states exactly what it intends to do, and waits for a person to say yes.
How the pause is implemented
The interruption happens before the tool call executes, not after. The runtime serialises the pending action — tool name, resolved arguments, a readable summary — surfaces it to a reviewer, and resumes only when a decision arrives. Because that wait can last minutes or hours, checkpointed state usually sits underneath it. In LangGraph this is the interrupt-before-node pattern; coding agents expose the same mechanism as a per-command permission prompt.
Getting the granularity right
Confirmation is only as good as the judgement built into it:
- Gate by risk rather than uniformly — reads and searches run freely, writes and spends stop.
- Show the resolved arguments, not the intention: “delete 1,284 rows from orders”, not “tidy up the table”.
- Offer scoped pre-approval for repetitive steps, or the reviewer starts clicking yes without reading — the failure mode that makes the control worthless while leaving it apparently in place.
Why it matters
Confirmation is what lets an otherwise autonomous loop be trusted with real systems: it converts a catastrophic mistake into a declined request. Remove it and the remaining defences are sandboxing, which only limits the blast radius, and the audit trail, which only tells you afterwards what happened.
Action confirmation is a control that pauses an agent before a consequential operation and requires explicit human assent to proceed. It applies per action — deleting a file, sending payment, pushing code — rather than to the run as a whole. Confirmation converts an irreversible step into a reviewable one, which is what makes autonomous execution acceptable on systems where a wrong action cannot be undone.
A good builder works away quietly for hours, but knocks on your door before knocking down a wall. Action confirmation is that knock.
Software that chases a goal on its own can handle most steps without bothering you — reading a document, checking a price, drafting a reply. But a few steps cannot be taken back: spending your money, deleting your files, emailing your client. For those, the software stops, tells you in plain words exactly what it is about to do, and waits for your yes.
It is the simplest way to let something work unsupervised without handing over the decisions you would most hate to get wrong.