Reviews
Risky operations escalate to a human for one-off approval. The agent holds on the wire with the exact statement attached, then continues the moment someone decides.
The gap
Most operations are obviously fine or obviously not, and a rule handles those. The expensive ones are in between: a migration that has to run, a backfill on a live table, a cleanup that is correct on Tuesday and a disaster on Friday.
Block them and you have an agent that cannot do the work you gave it. Allow them and you are trusting a model with a decision nobody signed off on.
How it works
Nothing reaches your resource while a review is open. The statement sits where it was intercepted until a person approves it or turns it down.
A review approves this statement, this time. It does not open a window, grant a role, or widen access for anything that comes after it.
The approver reads the exact operation, not a ticket describing it. No paraphrase to check and nothing to reconstruct later.
The connection is held open. Nothing is queued for a retry and no work is thrown away, so the agent resumes where it stopped.
Who asked, what they asked for, who decided, and when. The evidence is a byproduct of the decision rather than something reconstructed for an auditor.
The pause is the product
The agent is not told no. It is told to wait, and the connection stays open while it does. When the approval lands, the statement runs and the agent carries on with the work it was doing.
That is the difference between a control that governs an agent and one that just stops it.
UPDATE orders SET status = 'delivered'Risk: highEverything else passes or gets refused on its own. Free and open source under MIT.