new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

ai agent security/human-in-loop

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Human-in-the-loop controls: approval requirements

Require explicit approval for high-impact or irreversible actions. Implement action previews before execution. Set autonomy boundaries based on action risk levels. Provide clear audit trails of agent decisions and actions. Allow users to interrupt and rollback agent operations.

Action risk classification: RiskLevel enum and mapping

Define RiskLevel enum with four levels: LOW (read operations, safe queries), MEDIUM (write operations, API calls), HIGH (financial operations, deletion, external communications), CRITICAL (irreversible operations, security-sensitive actions). Map specific tools to risk levels: 'search_documents' → LOW, 'read_file' → LOW, 'write_file' → MEDIUM, 'send_email' → HIGH, 'execute_code' → HIGH, 'database_delete' → CRITICAL, 'transfer_funds' → CRITICAL. Auto-approve actions at or below configured threshold (default: LOW), queue higher-risk actions for human review.

High-impact action integrity controls

For destructive, financial, administrative, or externally visible actions: Separate decision-making from execution (agent proposes, policy service validates independently). Bind approval to exact action (include actor, tool name, target resource, normalized parameters, timestamp, expiry). Use short-lived authorization artifacts and replay protection for irreversible operations. Require step-up authentication for critical actions (account recovery, payment initiation, privilege changes, bulk deletion, production deployment). Make high-impact actions idempotent where possible; require explicit duplicate confirmation when idempotency is not possible. Fail closed when risk classification, approval validation, policy lookup, or audit logging fails.

MCP human-in-the-loop for sensitive actions

Require explicit user confirmation for destructive, financial, or data-sharing operations. Display full tool call parameters to the user, not just a summary name. Never auto-approve tool calls, especially in multi-server setups. Ensure the confirmation UI cannot be bypassed by LLM-crafted responses.

Give your agent this brain