01 / DECIDE
Architecture decision
Use it to create least-privilege profiles for inspection, routine edits, CI, and trusted maintenance.
Configuration chooses defaults, the sandbox enforces filesystem and network limits, and approvals govern exceptional authority. Map input, output, state, and side effects as one observable path before deciding which layer owns separate configuration, sandbox, and approval.
02 / BUILD
Three-step implementation
- 01
Frame the contract
Write down the caller, data classification, success condition, timeout, cancellation, and ownership. Use it to create least-privilege profiles for inspection, routine edits, CI, and trusted maintenance.
- 02
Build one narrow path
Implement one end-to-end path with request correlation, typed state, and reversible failure handling. Configuration chooses defaults, the sandbox enforces filesystem and network limits, and approvals govern exceptional authority.
- 03
Prove the outcome
Turn acceptance into a repeatable fixture, contract test, or browser test. Policy tests prove denied paths and networks remain denied and each escalation has a narrow, visible justification.
03 / BOUND
Production boundary
A permissive prompt cannot override sandbox enforcement, while a broad sandbox does not eliminate the need for approvals.
04 / PROVE
Acceptance evidence
Policy tests prove denied paths and networks remain denied and each escalation has a narrow, visible justification.
SOURCE / HTTP
Reproducible source probe
curl -fsSI 'https://learn.chatgpt.com/docs/agent-approvals-security' | sed -n '1,5p'