An Ask HN on controlling agents that take real actions converges on: LLM proposes → deterministic validator (rules, spend ceilings, replay checks) → human approve—especially for refunds, payments, and database writes where prompt 'never do X' fails.
Beta plugin sits between the model and your app: write hard-deny/soft-deny/allow rules in prose; Armor evaluates every tool call (powered by a decision model) and blocks policy violations before bash/git/exfil runs—Claude Code auto mode works via Ori on any OpenRouter model.