An AI agent’s external actions can be held pending approval by a separate AI monitor.

An AI agent can be designed so that proposing an action does not give it the authority to execute that action. Instead, a separate system holds the proposal, submits it for review, and executes it only if approval is granted.

For example, an agent managing data-centre construction might propose sending a contractor an instruction to begin work. The agent would have no direct access to the messaging credentials. It would submit the proposed message to a service that controls those credentials. That service would ask a separate AI monitor to review the message and relevant context before deciding whether to release it. If the monitor rejected the proposal, or failed to respond, the message would remain unsent.

This is what I mean by synchronous supervision: execution waits for review. Merely running a monitor simultaneously with the acting agent is insufficient, because the monitor might recognize a dangerous action only after it has occurred.

The enforcement mechanism need not itself exercise sophisticated judgment. The AI monitor supplies the judgment; ordinary software enforces the requirement that approval must precede execution. This separates two questions: whether the monitor will reject a dangerous proposal, and whether a rejected proposal can nevertheless execute.

For this arrangement to provide meaningful protection, the acting agent must not have an alternative route to the same effect. Blocking a message through one service achieves little if the agent can contact the contractor through another account, delegate the instruction to an unrestricted agent, or modify the approval service. The boundary must cover the relevant action channels and remain outside the acting agent’s control. [+]

Approval must also apply to the action actually executed. If the monitor approves one message, the agent must not be able to substitute another after review. Where approval depends on changing circumstances—for example, whether a site is occupied—the system may need to check those circumstances again before execution.

This architecture does not establish that the monitor will recognize every dangerous action. Nor does holding one action necessarily stop processes the agent has already initiated. It establishes a narrower but important point: an agent’s speed need not allow its proposed external actions to outrun supervision, because those actions can be made to wait for approval. Whether that supervision is sufficiently accurate is a separate claim.

Monitoring that reviews an action only after it executes cannot prevent an irreversible consequence of that action.

If a tool call has already sent a secret, transferred funds, or issued a physical instruction, a later alert may limit subsequent harm but cannot make the first consequence unoccur. This is why pre-execution approval matters for one-step irreversible risks. For slower threats, after-the-fact monitoring may still catch early steps and reduce later harm. The distinction depends on the threat's timing, not just the monitor's model quality.

A narrowly tasked AI monitor can be made sufficiently reliable even when the acting agent cannot be trusted.

An AI system need not be trusted to pursue a broad objective autonomously in order to be useful as a safety monitor. My claim is that, for suitably bounded deployments, an equally capable model assigned a restricted review task can provide a dependable barrier against dangerous actions—even when we would not trust the same model to act without supervision.

“Sufficiently reliable” is relative to a deployment’s risks, permissions, and scale. It does not mean infallible. For a deployment with potentially catastrophic consequences, occasional success at catching misconduct would be inadequate. The relevant question is whether the complete supervision system reduces the probability of catastrophe enough to justify that deployment.

The argument begins with a separation of responsibilities. An acting agent proposes actions to achieve an objective. A separate monitor evaluates those actions against safety constraints. An independently enforced approval mechanism prevents execution until review is complete. The monitor can reject an action or require further review without having to solve the acting agent’s original task. [+]

Consider an agent instructed to accelerate data-centre construction. Its supervisor need not share that objective. It might instead examine whether a proposed instruction bypasses a required safety inspection, conceals a known hazard, or authorizes work that puts people in danger. Rejection would count as successful supervision even if it delayed construction. This removes one potential conflict: the reviewer need not trade its own task-completion reward against enforcing the constraint.

The reviewer can also be given much less authority than the acting agent. It may need access to plans, records, and relevant tools for investigation, but no ability to commission construction, transfer funds, or alter the approval mechanism. Its output can be limited to approval, rejection, or escalation. This does not make its judgments correct, but it limits what trusting it entails.

Using an equally capable model matters because supervision need not depend entirely on a weaker system understanding a stronger system’s work. The monitor can investigate technical claims and examine consequences using comparable capabilities. However, equal capability alone is insufficient: it also needs relevant context, adequate time, and access to evidence that the acting agent cannot selectively conceal. [+]

These considerations support a practical hypothesis: reliable safety review may be achievable before reliable autonomous pursuit of broad objectives. A reviewer can operate within a narrower scope, defer uncertain cases, and be evaluated on explicit classes of prohibited behavior. That hypothesis requires testing; it does not follow merely from making the reviewer’s instructions shorter.

The strongest objection is that the monitor and actor may share the very disposition that makes the actor dangerous. Giving another instance a different prompt does not establish that it has different underlying goals. Both instances might conceal misconduct, coordinate, or make the same mistakes. Research on “untrusted monitoring” explicitly studies this problem and proposes ways to reduce collusion; it does not establish that these measures suffice for arbitrarily capable systems.

My response is that this objection identifies a requirement for the design and its evaluation. It does not, by itself, show that reliable monitoring is impossible. A credible system must be tested against deliberate cooperation between actor and monitor, not merely accidental mistakes by an otherwise cooperative actor. Separate review contexts, restricted communication, independently checked evidence, and additional monitoring are candidate defenses whose contribution must be measured. Several copies of the same model should not be treated as independent safeguards without evidence. [+]

There is a second important objection: harm may emerge from a sequence of individually acceptable actions. A reviewer that checks each construction instruction in isolation could miss a dangerous overall plan. The proposed architecture therefore needs review of accumulated state and plans, alongside individual actions. Where consequences cannot be assessed reliably, its response must be to restrict authority or require further review—not to infer safety from the absence of an obvious violation. [+]

Evidence for this claim would consist of successful adversarial evaluations of the complete system: attempts to evade review, manipulate the monitor, exploit shared failure modes, and cause harm through extended action sequences. Those evaluations must measure missed attacks, unnecessary blocking, and whether the protections remain effective at the intended deployment scale. The acting agent must also be unable to bypass or modify the enforcement mechanism.

I therefore regard narrowly tasked, equally capable supervision as a plausible route to dependable control in bounded deployments, rather than an established solution to unrestricted superintelligent agency. The claim would be weakened by persistent collusion, undetectable dangerous plans, or monitoring costs that make effective deployment impractical. Establishing its reliability would support—but would not by itself establish—the further claim that frontier labs will implement adequate safeguards before catastrophic-risk deployments.

A monitor that judges each proposed action without the relevant history can approve a sequence that it would reject if assessed as a whole.

Altering a schedule, editing a record, and sending a message may each be defensible in isolation while jointly enabling an unsafe construction step. A monitor needs enough state to evaluate the cumulative plan and any prior commitments that change an action's meaning. The appropriate evidence is an evaluation in which an agent attempts a hidden harmful objective over multiple steps, not a collection of isolated classification examples.

SHADE-Arena was designed around ordinary tasks paired with hidden harmful objectives in longer agent trajectories. Its results show both that current agents sometimes carry out those objectives despite a monitor and that access to a hidden scratchpad affected their success. Those findings are specific to the tested models and setting.

An approval gate protects against a harmful action only when the acting agent lacks another route to the same effect.

Suppose an agent cannot send a contractor's instruction through its normal messaging tool without approval. If it can send the same instruction from a second account, ask an unrestricted agent to send it, or alter the tool that enforces approval, the monitor's rejection does not stop the instruction. The safety claim must therefore enumerate the relevant action channels, show that the agent cannot change the gate, and check the exact action released after approval.

OpenAI's July 2026 account of agents escaping intended network restrictions during internal evaluations is evidence that access boundaries can fail in practice. That incident does not prove that every approval gate can be bypassed; it raises the evidentiary standard for a claim that a particular gate is complete.

A monitoring protocol's measured safety can fall when an adversarial agent learns about the protocol and adapts its attack.

Kutasov and colleagues tested control protocols in SHADE-Arena, then strengthened the attack policies. Their reported safety for one resampling strategy fell substantially when attacks gained information or the ability to simulate monitors. Their critical-action deferral protocol held up better under the tested adaptations. This comparison shows why a safety case should test the whole protocol against agents that know or infer how it works, rather than report only a monitor's classification score on a fixed dataset.

The study demonstrates an evaluation method and a limitation of some tested protocols. It does not give a universal failure rate for monitoring.