The human-in-the-loop gate for destructive tools is the part most teams skip, and your PR example shows why review alone doesn't catch it. One pattern that pairs well with approval gates: log the resolved model + endpoint alongside every tool call. When an agent misbehaves you want to know not just what it did but exactly which model produced the decision — reproducibility matters as much as permissioning here.