How to Design Agent Permissions, Approvals, Stops, and Recovery
Limit access first, require approval before consequential actions, define stop conditions, and verify a recovery path before the agent runs.
Permissions define the maximum an Agent can do. Approvals decide whether a particular action may proceed. Stop conditions interrupt the run when something abnormal occurs. Recovery provides a path back to a safe state. These controls solve different problems and cannot be replaced by one confirmation button.
An Agent may ask before every write yet still have permission to read an entire mailbox. Another Agent may be limited to one folder, but a mistaken approval can still cause damage when no backup exists.
OpenAI documents least privilege, write approvals, action constraints, and safety warnings. The four-control model in this lesson is my design method for everyday work. Available controls still depend on the product, plan, and administrator settings.
Permissions: reduce capability and data scope first
Enable only the apps, folders, accounts, and actions required for the task. Use read-only access when the task only organizes information. If the Agent only needs to edit a copy, do not provide the production folder. Keep network access off when the task does not require it.
OpenAI’s Workspace Agents guidance recommends limiting connections and access to what the Agent needs. OpenAI: Workspace Agents
Approvals: put consequential actions in front of a person
Approval points belong immediately before actions that change external state: sending, publishing, paying, deleting, changing permissions, or overwriting production files.
Do not require approval for every harmless read. Excessive prompts train people to approve without reading.
OpenAI’s app controls can distinguish read-only access, custom actions, and requests for approval before supported write actions. Some high-risk actions may also be blocked. OpenAI: Admin controls for apps
The approver still needs to understand what will happen, to whom, and with what impact. “Allow” is not meaningful review by itself.
Stop conditions: interrupt before an anomaly expands
Define conditions such as:
- the Agent encounters unauthorized or sensitive data;
- it requests a new tool, login, or higher permission;
- the plan moves outside the original goal;
- it repeats an action, fails several times, or produces unverifiable output;
- it encounters suspicious instructions, prompt injection, or an unfamiliar site.
OpenAI’s safety guidance recommends enabling only necessary apps, avoiding open-ended tasks such as “process all my email,” and stopping when something looks suspicious. Confirmations and other safeguards reduce but do not eliminate risk. OpenAI: ChatGPT agent
Recovery: know the return path before approval
Recovery may use a copy, version history, Git commit, database transaction, trash, or explicit rollback. Confirm that the path actually works before execution.
Some actions cannot be meaningfully reversed: an email was delivered, data became public, or another person received a notification. Keep those actions as drafts with human release rather than pretending that deleting your sent copy restores the world.
Practice: complete an Agent control checklist
Task:
Allowed reads:
Allowed writes:
Explicitly prohibited:
Actions requiring approval:
Information the approver must see:
Stop conditions:
How to interrupt the run:
Pre-run backup or version:
Recovery steps:
Irreversible impact:
Final reviewer:Practice with five copied files and no external login. For every write or external action, you should be able to answer: Why is this permission available? Who approves? When does the run stop? How does the work return to a safe state?
Do not schedule the process next. Run it several times with representative inputs and verify that it fails safely before considering automation.