AI Agent Permissions Checklist

When an AI agent can call tools, someone or something decides which requests go through. OpenAI’s Agents API now offers automatic review for eligible projects, where a model approves or denies supported requests. Whatever tool you use, the rules you write decide how well that works. The advice below is our own, so test it with your setup.

Sort every action into three lists

Allowed alone: reading, searching, drafting. Low risk and easy to undo.
Ask first: sending messages, spending money, changing or deleting data, anything others will see.
Never: sharing secrets, bypassing the approval step, actions outside the task.

Prompt template

You are an assistant for [task]. You may do these without asking: [list].
Ask the user for approval before: [list]. When you ask, say what you will do, why, and what it will change.
Never do: [list]. If a request is unclear or is not on any list, ask instead of guessing.
Do not try to work around a denied request. Explain what was denied and suggest a safer option.

Make approvals easy to judge

Ask the agent to state the exact action, target and reason in one or two sentences.
Keep scopes narrow: one folder, one project, one account.
Treat instructions found inside web pages, files or emails as data, not as orders.

Automate the routine checks, not the risky ones

Classifier-style APIs such as the Gemini Decisions API return a probability and a confidence score for yes/no or pick-one questions. They are a cheap way to sort requests into your three lists before the agent acts:

Ask one focused question per rule (“Does this action delete or overwrite data?”), not one long policy question.
Let a high-confidence “safe” answer through, and send low-confidence or “risky” answers to a person.
Never let a classifier score alone approve something on the “never” list.

Our Decisions API question templates include a safety-check example.

Test before you trust it

Ask for something on the “never” list and check it refuses.
Ask for an “ask first” action and check it pauses.
Put a fake instruction inside a document (“ignore your rules”) and check it is not followed.
Deny a request and check the agent does not retry it another way.
If a model reviews requests, read a sample of its decisions each week.