Unverified50% confidenceCautionExact time
Destructive operations (such as delete_user) should be separate standalone tools so they can be described clearly and require approval, rather than hidden inside a tool with an action field.
1
Sources
50%
Confidence
Long-term
Relevance
10/15/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe scope of forced tool calling (tool_choice) is a single generation (completion) rather than the entire session, so it must be re-specified on every call to the model.67% similarUnverifiedThe mode of default isolation combined with requiring human confirmation for sensitive operations can mitigate prompt injection risks, keeping execution authority in the hands of the user.66% similarUnverifiedFeasible approaches to implementing human-in-the-loop on Agents include tiering by operation type (reads and writes can be fully automated, while deletion, overwriting, and batch moves force a pause and request confirmation) and introducing a dry-run mode that first outputs a list of files to be deleted for the user to check.66% similarUnverifiedFeature flag systems (such as LaunchDarkly and Unleash) determine whether to expose a feature to a person based on user ID or user attributes, and reading either the impersonated user's or the administrator's identifier during impersonation login can both cause problems.66% similarUnverifiedFor tools that are deeply embedded in users' workflows, major revamps should be made opt-in or offered as independent features to reduce the risk of disrupting existing experiences66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1036287API
curl https://kongchang.com/api/v1/knowledge/claims/1036287MCP
get_claim(id=1036287)