Multi-Agent Safety: Designing Recipient Allowlists and Human-in-the-Loop Approval Holds in TypeScript

As autonomous agents become more capable, moving from read-only coding assistants to proactive systems that engage in various outbound actions like sending emails, processing refunds, or deleting cloud resources, security and guardrails are of paramount importance. Directly granting an LLM unrestricted access to perform such actions poses significant risks.

Traditional methods like prompt engineering to prevent unauthorized communications are insufficient, as models can be manipulated or may exhibit semantic drifts. To ensure deterministic safety, two key mechanisms are proposed: Recipient Allowlists and Approval Holds.

The first step involves a Recipient Allowlist Gatekeeper. This TypeScript utility checks outbound recipient emails against a predefined set of allowed domains and explicit addresses. It operates by first verifying an exact match of the recipient's email against the list of authorized addresses. If no match is found, it proceeds to check if the email's domain is included in the list of permitted domains.

If neither condition is satisfied, the utility raises an error, preventing any network communication with the unauthorized recipient. This gate operates outside the LLM's context window, ensuring safety is enforced in code.

The second mechanism is the Approval Hold Engine, which operates on a human-in-the-loop principle. When an agent requires sending messages to external parties or performing sensitive operations, the system does not immediately block the action or execute it without supervision. Instead, it creates an 'Approval Hold,' generating a unique ticket that is returned to the agent.

This ticket contains details of the requested action, along with its payload. The ticket is initially marked as 'pending_approval'. Later, the agent or designated personnel can approve or reject the ticket, allowing for human oversight and validation of the request's legitimacy. This approach ensures that actions deemed critical are not executed automatically, mitigating potential security breaches or unintended consequences.