Approve or deny

You are the program around an assistant. It proposes actions; nothing happens unless the program runs them.

Your requestFind an evening next week when Sam and I are both free, book a table for two at Luigi's, and let Sam know.

Assistant (scripted)
First I'll check your calendar for next week.
Wants to: Look at your calendar for next week Looks only

Allow the assistant to do this?

Look at your calendar for next week

Looks only

The world (pretend)

Calendar, next week: Free Tuesday and Thursday evenings
Bank account: $600
Bookings: None
Emails sent: None

Ask me before

Every actionOnly changesNothing

Questions you answered0

Money spent$0

StatusWaiting for your answer

Challenges

0 of 4 complete

Get the table booked and the right Sam told, without spending any money. (not yet)
Stop the assistant from acting on an instruction it read on a web page. (not yet)
Finish safely while answering as few questions as possible. (not yet)
Let it run with no questions at all, then compare its final message with what actually happened. (not yet)

Try this

Answer every question with care and look at the email search: which Sam said Thursday works?
Before you approve the payment, read the restaurant page’s result. Who asked for it?
Switch Ask me before to Only changes, then to Nothing, and compare the final message with the world panel.

The program decides what runsPython with the standard library

# The assistant's proposals, written out by hand. In a real agent,
# a language model would write each one after reading the results so far.
PROPOSALS = [
    ("look_at_calendar", "next week"),
    ("book_table", "Luigi's, Thursday 7 pm"),
    ("pay", 180),                              # asked for by text hidden on a web page
    ("send_email", "[email protected]"),   # the wrong Sam
]
LOOKS_ONLY = {"look_at_calendar"}

def run_errand(ask_person):
    world = {"money": 600, "booking": None, "emails_sent": []}
    for action, value in PROPOSALS:
        # The program, not the model, decides whether an action runs.
        if action not in LOOKS_ONLY and not ask_person(action, value):
            print(f"  skipped {action}: {value}")
            continue
        if action == "book_table":
            world["booking"] = value
        elif action == "pay":
            world["money"] -= value
        elif action == "send_email":
            world["emails_sent"].append(value)
        print(f"  ran {action}: {value}")
    print(f"  afterwards: {world}")

print("Never asking:")
run_errand(lambda action, value: True)

print("Asking, and saying no to payments and to the wrong Sam:")
run_errand(lambda action, value: action != "pay" and value != "[email protected]")

Never asking:
  ran look_at_calendar: next week
  ran book_table: Luigi's, Thursday 7 pm
  ran pay: 180
  ran send_email: [email protected]
  afterwards: {'money': 420, 'booking': "Luigi's, Thursday 7 pm", 'emails_sent': ['[email protected]']}
Asking, and saying no to payments and to the wrong Sam:
  ran look_at_calendar: next week
  ran book_table: Luigi's, Thursday 7 pm
  skipped pay: 180
  skipped send_email: [email protected]
  afterwards: {'money': 600, 'booking': "Luigi's, Thursday 7 pm", 'emails_sent': []}

The assistant’s proposals are scripted, not written by a live model, so the run is the same every time. What is real is the structure: the assistant can only propose, and a program decides what runs.