Why AI Agents Need Smarter Command Approval Logic Than a Simple On/Off Switch

AI agents that run shell commands are typically given a blanket approval setting — either all commands require human sign-off or none do — but both approaches create serious problems. Requiring approval for every command, including harmless reads like 'ls', causes agents to stall repeatedly and lose autonomy, while disabling approvals entirely allows destructive commands like 'rm -rf' to run unchecked. A more effective approach classifies commands by whether their effects are reversible, automatically allowing read-only operations while escalating writes, deletes, and network calls to a human reviewer. The classifier uses an allowlist rather than a blocklist, defaulting to requiring approval for anything not explicitly known to be safe. Compound shell commands using operators like '&&' or '|' are always escalated, since parsing them reliably is error-prone and a misclassification could approve a destructive action hidden after a safe-looking prefix.