An Ask HN on controlling agents that take real actions converges on: LLM proposes → deterministic validator (rules, spend ceilings, replay checks) → human approve—especially for refunds, payments, and database writes where prompt 'never do X' fails.
As major sites start blocking unauthorized agents, practitioners advise testing booking flows first and routing purchases through official agent paths—Yelp Places API, Shopify agent checkout, and Meta Muse partners like Walmart, Best Buy, and Sephora.
Show HN: Statewright's Rust engine enforces plan/implement/test states for Claude Code (and other CLIs) via MCP hooks—wrong tools are blocked structurally, shrinking death spirals for both small and frontier models.
An Indie Hackers founder almost shipped a no-auth “delete all users” endpoint Claude cheerfully wrote for a supposed test env—then built Thorim, a one-command layer of specialist agents/skills that makes coding agents challenge unsafe requests.