"Shall We Approve?" Consequence-Aware Approval for Autonomous Coding Agents

"Shall We Approve?" Consequence-Aware Approval for Autonomous Coding Agents. By Weiheng Wu and five others, from Singapore Management University. Published on the twenty-ninth of October.

Coding agents increasingly rely on automated approvers to decide whether a proposed shell command may run. The approvers in use, from rule-based checkers to guardrail models and deployed permission classifiers, decide from text: the request and the command. Yet what a command actually does depends on the code it invokes and on the state of the workspace. Systems that do observe file changes leave the assessment to the agent or to a human, after the command has already run.

Caper is a consequence-aware approval mechanism. Instead of judging a command by how it reads, it judges by what it was observed to do, and it makes that judgment before anything is committed.

Each command is pre-executed in a snapshotted sandbox. An independent approver then receives a bounded report of the effects observed there. Allowed commands are committed. Blocked ones are rolled back, and the agent is handed a reason it can act on.

Caper is compared with six existing systems. On SABER it has the lowest harmful-outcome rate, six point seven percent against at least fourteen point eight percent. The authors also build YoloFS-Ext, a benchmark in which harmful behaviour is hidden inside the tools a command invokes. There, Caper's harmful-outcome rate is seven point eight percent, against at least thirty-five point three percent. Meanwhile it blocks one percent of the safe twins of the dangerous tasks in YoloFS-Ext.

The wider margin comes on YoloFS-Ext, where the danger lives inside invoked tools and the text of a command reveals little of it. An approver that sees only text has little to go on there. Running the command first, observing what happens, and keeping the ability to undo it gives the approver evidence about consequences instead of words.