LLM agents can trigger real actions now. But what actually stops them from executing?

About this article

We ran into a simple but important issue while building agents with tool calling: the model can propose actions but nothing actually enforces whether those actions should execute. That works fine… until the agent controls real side effects: APIs infrastructure payments workflows Example Same model, same tool, same input: #1 provision_gpu -> ALLOW #2 provision_gpu -> ALLOW #3 provision_gpu -> DENY The key detail: the third call is blocked before execution No retry No partial execution...