Discussion on "Your agent can delete production. Nobody approved it."

JAY TANK · 2026-08-31T03:52:47.197Z

Here is a pull request that passes every test, reads cleanly in review, and ships a genuinely dangerous change: @tool def delete_customer(customer_id: str) -> str: db.execute("DELETE FROM customer

Glad it landed — the provenance framing is exactly the runtime half. One nuance if you add it to the README: log the resolved model id from the response (what the provider says served the call), not just the requested one. On routers and gateways the two can differ, and the response field is the only one that's true after a fallback.

That's the sharpest part of the whole thread - thank you. You're right: the requested model is an intention, the response's model id is the fact, and after a router fallback they diverge exactly when you most need the truth. I'll add it to the README's provenance note as the explicit guidance: log the resolved model from the response payload (and the endpoint/gateway that served it), not the argument you passed in. Appreciate you closing that loop.

The human-in-the-loop gate for destructive tools is the part most teams skip, and your PR example shows why review alone doesn't catch it. One pattern that pairs well with approval gates: log the resolved model + endpoint alongside every tool call. When an agent misbehaves you want to know not just what it did but exactly which model produced the decision — reproducibility matters as much as permissioning here.

Well put - approval gates answer "should this run?", provenance answers "who decided it?", and an incident needs both. The key word is resolved: teams log model="gpt-4o" but not the dated snapshot, endpoint, or params, so the one call that misbehaved can't be reproduced.

handbrake stays static on purpose - it gates the missing approval at the PR, before anything runs - so per-call provenance is the complementary runtime half of the same story. Might add "log the resolved model + endpoint alongside destructive tool calls" to the README as a companion practice. Appreciate the thoughtful note.

Search Hashnode

Your agent can delete production. Nobody approved it.

Responses(4)