Governing agent autonomy with Auto-review

Summary

Auto-review governs local agent autonomy as a continuum, allowing routine work to proceed while reviewing actions whose consequences depend on context, user intent, and security stakes. A small classifier agent runs before tool calls in the same RPC stream as the parent agent, and can inspect workspace contents with ReadFile, Grep, Glob, and ListDir when a command alone is insufficient. Its blocks return explanations rather than automatically prompting users, enabling the parent agent to narrow or replace a risky action. Evaluation used 6,122 deduplicated labeled rows from internal developer sessions plus synthetic high-consequence cases, and tested tool use, overrides, parse failures, and behavioral flapping. Early results show the classifier blocks around 4% of reviewed actions, while about 7% of Auto-review chats experience at least one interruption.

Takeaways

1. 1

   The classifier is designed to be a small, sufficiently reasoning-capable model; lower-reasoning models were not always faster because struggling with policy or tool calls could consume more time and tokens.

2. 2

   Evaluation combined 6,122 deduplicated labeled rows from roughly 12 hours of internal developer sessions with synthetic cases involving secrets, production data, untrusted instructions, and large side effects.

3. 3

   The classifier currently blocks around 4% of reviewed actions, while about 7% of total chats in Auto-review mode produce at least one user interruption; many blocked actions are resolved by the parent agent.