An AI agent’s external actions can be held pending approval by a separate AI monitor.

An AI agent can be designed so that proposing an action does not give it the authority to execute that action. Instead, a separate system holds the proposal, submits it for review, and executes it only if approval is granted.

For example, an agent managing data-centre construction might propose sending a contractor an instruction to begin work. The agent would have no direct access to the messaging credentials. It would submit the proposed message to a service that controls those credentials. That service would ask a separate AI monitor to review the message and relevant context before deciding whether to release it. If the monitor rejected the proposal, or failed to respond, the message would remain unsent.

This is what I mean by synchronous supervision: execution waits for review. Merely running a monitor simultaneously with the acting agent is insufficient, because the monitor might recognize a dangerous action only after it has occurred.

The enforcement mechanism need not itself exercise sophisticated judgment. The AI monitor supplies the judgment; ordinary software enforces the requirement that approval must precede execution. This separates two questions: whether the monitor will reject a dangerous proposal, and whether a rejected proposal can nevertheless execute.

For this arrangement to provide meaningful protection, the acting agent must not have an alternative route to the same effect. Blocking a message through one service achieves little if the agent can contact the contractor through another account, delegate the instruction to an unrestricted agent, or modify the approval service. The boundary must cover the relevant action channels and remain outside the acting agent’s control. [+]

Approval must also apply to the action actually executed. If the monitor approves one message, the agent must not be able to substitute another after review. Where approval depends on changing circumstances—for example, whether a site is occupied—the system may need to check those circumstances again before execution.

This architecture does not establish that the monitor will recognize every dangerous action. Nor does holding one action necessarily stop processes the agent has already initiated. It establishes a narrower but important point: an agent’s speed need not allow its proposed external actions to outrun supervision, because those actions can be made to wait for approval. Whether that supervision is sufficiently accurate is a separate claim.