Why separate the decision to act from the action itself?

A reliable pattern is to split deciding to act from doing it. The agent proposes an action; an independent check validates it against policy and permissions before it executes. OWASP’s agent security guidance builds on exactly this separation, with validation sitting between intent and effect.^[1]

The word “independent” is carrying weight there. If the check is just the same model asked to double-check its own plan, it inherits whatever mistake led to the plan in the first place — a model convinced a refund is justified will usually stay convinced when asked to review that same refund a second time. A real check runs on something other than the proposing model’s own judgment: a fixed policy (“refunds over $50 need a human”), a schema the proposed action must satisfy, or a separate reviewer with different information or a different, narrower mandate.

Reversibility is the variable that decides how tight this gate needs to be. A step that is cheap to undo — drafting a reply nobody has seen yet, running a read-only query — can afford a lighter check or none at all. A step that cannot be undone once it runs earns the strictest version of this pattern: propose, then wait for a check that does not share the proposer’s blind spots.

A schema can play the same role without a human anywhere in the loop. A proposed database write that must match an allowed set of columns and value ranges before it executes gets rejected mechanically the moment it falls outside that set, the same way a type check rejects malformed input — no one has to be watching that particular run for the rule to hold.