https://t0ul.com/tags/human-in-the-loop/Recent content in Human-in-the-Loop on t0ulHugoen-usTue, 30 Dec 2025 00:00:00 +0000https://t0ul.com/blog/the-human-gate/Tue, 30 Dec 2025 00:00:00 +0000https://t0ul.com/blog/the-human-gate/<p><em>Part of my <a href="https://t0ul.com/blog/the-plan/">AI Security Engineering</a> series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with <a href="https://t0ul.com/blog/setting-up-the-lab/">Set up your lab</a>. The lessons are <a href="https://github.com/t0ul/ai-security-engineering">on GitHub</a>, and the agent itself lives at <a href="https://github.com/t0ul/emaildrop">t0ul/emaildrop</a>.</em></p> <h2 id="the-action-no-rule-should-take-on-its-own">The action no rule should take on its own</h2> <p><a href="https://t0ul.com/blog/least-privilege/">The last post</a> scoped what each tool is allowed to do. This one is about a category of action that no scope should ever grant automatically: the irreversible kind. Putting an event on your real calendar, following a link, sending something on your behalf, these are not things you want a confident model deciding by itself, no matter how well its tools are fenced. They need a person to say yes.</p>