Defining Authority for Automated Agent Approvals

Replacing repeated approval prompts with an automated reviewer changes who makes decisions about an agent's actions. For WTK, the important question is not only whether that reviewer makes good judgments, but what it is authorized to decide.

What OpenAI reports

OpenAI's April 30 auto-review report describes a separate agent assessing requests to act beyond a sandbox. It considers user intent, policy, environment, and likely consequences. The reported reviewer used GPT-5.4 Thinking at low reasoning effort.

OpenAI reports fewer interruptions and evaluates usability separately from safety. Its usability analysis uses internal traffic; safety assessment includes synthetic overreach, prompt-injection tests, and malicious trajectories. The report also describes stopping runs after repeated denials.

The limits are explicit. OpenAI reports red-team cases where the reviewer approved actions it should not have. Review at escalation does not cover every action inside the sandbox, nor guarantee protection against concealed intent. These are April observations, not a current-model comparison or a WTK result.

Define the reviewer's authority before delegating decisions

Our interpretation is that automated review introduces another permission decision, rather than removing the need to define permissions. Before using it, an operator needs to distinguish actions the environment already permits, exceptions a reviewer may approve, and decisions reserved for a person.

Consider a hypothetical agent repairing a test service. It asks to download a dependency from an approved registry. A reviewer might be allowed to approve that specific request under a policy established beforehand. The same reviewer should not automatically be able to approve uploading private logs to an unfamiliar host just because the agent says it would help debugging.

The difference is not how persuasive the request sounds. It is whether the action fits the authority delegated to the reviewer. Credentials, destinations, data sensitivity, and the intended side effect matter. A request to change that delegation is a different decision from a request to act within it.

This extends our note on tasks that exceed an agent's permissions. That note asks what happens when work becomes blocked. Here we ask who may approve the proposed exception, and under which conditions.

Keep enforcement separate from judgment

For the WTK approach, we would want the runtime to enforce restrictions that the reviewer cannot remove through its answer. We would also want an approval tied to the actual operation being executed, not reused after its destination or arguments change. These are our design requirements, not controls demonstrated by this article.

The public action-authorization architecture provides a place to examine that distinction. A reviewer's assessment can inform an authorization decision without becoming unrestricted authority over the environment.

What remains open for WTK

Before proposing a WTK comparison, we need to identify an actual target runtime, its existing approval path, and which exceptions could legitimately be delegated. Otherwise we would be evaluating an imagined permission system rather than our deployed one.

The relevant evidence would need to distinguish permitted work, mistaken approvals, unnecessary refusals, and actions the reviewer never sees. A lower interruption count alone would not settle whether the arrangement is appropriate. This note does not create an experiment recommendation or change our human publication and deployment approvals.

Our takeaway: automate a defined class of decisions, not the power to redefine that class. A second agent can contribute judgment; the scope of its authority still needs an accountable owner.

Source

Maja Trębacz and colleagues, OpenAI, Auto-review of agent actions without synchronous human oversight, April 30, 2026. The WTK requirements and hypothetical example above are our interpretation, not independently verified OpenAI outcomes or demonstrated WTK capabilities.