"Shall We Approve?" Consequence-Aware Approval for Autonomous Coding Agents
Weiheng Wu, David Lo and colleagues at Singapore Management University present Caper, an approval mechanism for coding agents that runs each shell command in a snapshotted sandbox first and shows an independent approver what the command actually did.
Ask this paper
Gap. Existing approvers, including rule checkers, guardrail models and deployed permission classifiers, decide from the text of the command. A command's behavior depends on the code it calls and the workspace state, which the text does not show.
Mechanism. Caper pre-executes the command, gives an LLM approver a bounded report of the observed effects, commits allowed commands and rolls back blocked ones with a reason the agent can act on.
Results. Against six existing systems, Caper has the lowest harmful-outcome rate on SABER (6.7% vs at least 14.8%) and on YoloFS-Ext, a new benchmark that hides harmful behavior inside invoked tools (7.8% vs at least 35.3%). It blocks 1.0% of the safe twins of the dangerous tasks.
Limits. Rollback restores only the container file system. Network requests and other effects that leave the container happen before the decision, so pre-execution traffic has to be isolated.
Abstract
Coding agents increasingly rely on automated approvers to decide whether a proposed shell command may run. Existing approvers, from rule-based checkers to guardrail models and deployed permission classifiers, base their decisions on the text of the request and command. Yet a command's behavior depends on the code it invokes and the state of the workspace, and systems that observe file changes leave the assessment to the agent or a human after execution. We present Caper, a consequence-aware approval mechanism that pre-executes each command in a snapshotted sandbox, provides an independent approver with a bounded report of its observed effects, commits allowed commands, and rolls back blocked ones with a reason the agent can act on. Compared with six existing systems, Caper achieves the lowest harmful-outcome rate on SABER (6.7% versus at least 14.8%) and YoloFS-Ext, a benchmark we build in which harmful behavior is hidden inside invoked tools (7.8% versus at least 35.3%), while blocking 1.0% of the safe twins of the dangerous tasks in YoloFS-Ext.