THE PROBLEM
Why this pattern exists
An LLM may interpret language and propose actions but is not a safe owner of financial, contractual or transactional invariants.
DESIGN GUIDANCE
Principles to preserve
- Model output is a proposal, never proof of permission.
- Validate schema, identity, scope, preconditions and policy before any side effect.
- Distinguish read, propose, approve, execute and compensate permissions.
- Use idempotency keys and transactional boundaries for state changes.
- Retain structured evidence of decision, execution and outcome.
THE REAL DESIGN WORK
Trade-offs, not just boxes
- Approvals improve risk control but add handoff latency.
- Schema constraints narrow model flexibility but make integrations testable.
- Compensation may be unavailable for irreversible external effects; design compensating business processes.
REVIEW QUESTIONS
Before you implement
- Can a malicious or mistaken prompt bypass execution policy?
- How are stale context and concurrent updates rejected?
- Where does an irreversible action require escalation?
- Can we replay the audit without replaying the model?