Human approval for agent tool calls has to live in the tool layer, not the prompt
Notes comparing four frameworks find that approval via a system-prompt line breaks exactly where it matters, because the model itself decides whether to ask. The durable pattern is gating by action type: reads run free, while anything that sends, spends, or deletes pauses for a human yes.