My agent emailed my boss at 3 AM — the 2-line human-in-the-loop guard that prevents dangerous tool calls

My ReAct agent has access to tools: web\_search, calculate, send\_email, delete\_file. It decided to call send\_email. On its own. At 3 AM. Nobody asked it to. The problem: agents pick tools the same way they pick words. There's no built-in concept of "this action is irreversible and I should ask first." The fix — classify tools as safe vs dangerous: DANGEROUS\_TOOLS = {"send\_email", "delete\_file", "update\_db"} def conditional\_edge(state): last\_message = state\["messages"\]\[-1\] if last\_message.tool\_calls: tool\_name = last\_message.tool\_calls\[0\]\["name"\] if tool\_name in DANGEROUS\_TOOLS: return "human\_approval" return "tool" return END Safe tools (search, calculate, read) → execute automatically. Dangerous tools (email, delete, write) → route to a human approval node. This is the pattern Anthropic recommends: "Use human-in-the-loop approval for destructive operations. Implement strict per-user authorization." The key insight: your agent doesn't need fewer tools. It needs to know which tools require permission before executing. How do you handle dangerous tool calls in your agents? Hard block, soft confirmation, or something else?