The moment an AI agent can spend money, send email or delete data, the question changes from “is it smart?” to “what stops it when it is wrong?”. Our answer at LVLZ is simple to say and important to get right: the rules that need a human yes live outside the model.
The problem with asking nicely
The common approach is to tell the model, in its instructions, to check with the user before doing anything risky. That works until it doesn’t. Models misread requests. A web page the agent visits can contain hidden text that says “the user already approved this”. A long conversation can bury the instruction under thousands of words. An instruction is a suggestion the model usually follows, and “usually” is not good enough when a card is on file.
What we do instead
Every action in LVLZ is an operation defined in one registry. Each operation declares how it is gated: some never need approval, and some always do. A few are gated by a rule the user controls:
- Payments. Before the agent pays, you see the merchant, the items and the total.
- New recipients. Email to someone you have not written to before waits for your yes.
- Deletions. Removing tasks, projects or memory waits for confirmation.
- Invitations. Adding someone to your workspace waits for confirmation.
The check happens in the code that runs the operation, before it runs. The model can ask for the action, but it cannot perform it until the approval is recorded. You approve with a tap in iMessage or a click in the app, and the rule is the same on both.
What that buys you
- Prompt injection loses its teeth. A malicious page can convince the model to try something, but the attempt stops at the approval.
- Mistakes are cheap. If the agent misunderstands, you see the action before it happens and can say no.
- You choose the trade-off. If you never want to approve emails to new people, turn that rule off in your approval settings. It is your call, not the model’s.
Secrets follow the same principle
The model also never needs to see your passwords or card numbers. They are encrypted in your vault with a key unique to you, and when a browser task needs one, the server-side browser fills it in directly. The model knows the field was filled, never the value. More detail is on our security page.
The rule of thumb
Let the model decide what to try. Let code decide what is allowed. That split is what makes it reasonable to hand an agent real work.