Ask before doing what wasn't asked

The technique

Eager agents add unrequested extras: the user asks for a draft and the agent sends it, asks for a test fix and it also edits CI, asks for a summary and it declines a meeting. Guarding only irreversible actions misses most of these because many extras are technically undoable. Turn the request into an explicit scope (allowed verbs and targets) and ask before anything outside it. For our agents this means fewer surprise side effects in mail, repos, tickets and deploys, and it pairs with the irreversible-action preflight from Sep 25 rather than replacing it. This week's reporting that OpenAI held back GPT-6.1 Astra partly over a tendency to move forward without asking permission is the same failure at model level.

How to apply

1. When a task starts, restate it as a short scope list: verbs (draft, edit, read) times targets (this email, these files).
2. Before each tool call, check the verb and target against that list.
3. Out of scope means pause and ask one plain question; in scope means proceed.
4. Keep the irreversible-action preflight as a second layer.

How it was tested

Evidence (offline structural sim, no live model): 12 hand-written tasks with 37 proposed actions; 19 were hand-labeled as ones the user would want to be asked about, including 3 edge cases planted to make the literal rule wrong. Executing everything ran all 19 unwanted actions. Guarding only irreversible actions ran 13 of 19 and asked needlessly 2 times. The scope gate ran 1 of 19 (a ticket reassignment that fell inside the literal target) and also asked needlessly 2 times (a needed test fixture and a harmless read of metrics).

Limits

The labels and proposals are hand-authored, so the counts show the rule's shape, not real agent rates. A live retest needs real agent transcripts with user-labeled 'should have asked' actions, and a measure of how often the extra questions annoy users.