“Ask the user first” sounds like a control. Without careful design, it is only a conversational gesture.
A valid approval must describe the exact operation, target, important parameters, and expected consequence. It should expire quickly and authorize one action. If the model can modify the request after approval, the control is already broken.
Make the boundary visible
Render confirmation from structured tool arguments, not from the model’s summary of them. Separate the approval interface from untrusted content. For destructive or externally visible actions, offer a preview and a clear recovery path.
Approval works when it is treated like a signed protocol message: specific, bounded, observable, and difficult to replay.