How to keep an AI agent from booking without asking
To keep an AI agent from booking without asking, do not rely on an instruction in a prompt. Use a tool that stops before any write and asks you in your own browser. Wield does this: a recipe that changes data stops before its first write request and opens an Allow window that shows every request and its body. Deny is the default. Two minutes without an answer also counts as a deny. No setting can turn the window off.
Why prompts are not enough
A prompt such as "always ask me before booking" is a request to the model, not a control on the tool. A model can misread the request, get a new instruction from a web page, or be asked by a user to skip the step. A structural control does not depend on the model's judgment. If the tool cannot send the write without your click, the agent cannot send it either.
How the Allow window works
When an agent runs a write recipe, Wield does the following:
- It checks the parameters and the recipe's signature.
- It builds the requests the write would send, but sends none of them yet.
- It opens a window in your browser and waits.
- If you click Allow, it sends the requests for that one run. If you click Deny, or do nothing for two minutes, it stops and returns
confirmation_denied.
One Allow covers one run. The next write needs a new Allow.
What you see in it
The window shows:
- the site and the task;
- the recipe's summary, filled in with your values;
- each request, with its method, path and the body exactly as it will be sent. Tokens in the body are masked.
Read the body before you click Allow. For a booking, check the date, the time, the person and the place. For a message, check the recipient and the text. If anything differs from what you asked for, click Deny.
Esc also denies. The agent receives a denial and should not retry unless you ask it to.
Org policy: deny writes entirely
Administrators can go further. An organization policy with Writes: deny hides every write recipe from members and stops them from running. Use this for a team that should only search, never book or send. A policy can only restrict. It cannot skip the Allow window for the writes that remain.
Which recipes write today
As of 7 Nov 2026, two recipes are marked as writes:
| Recipe | What it writes | Status |
|---|---|---|
doctolib.de/book-slot | Selects a slot in your account and returns the practice's notices | Untested. It needs a logged-in recording before it is verified. |
kleinanzeigen.de/message-seller | Sends a message to a seller | Untested for the send step. Its read half is checked. |
The Doctolib recipe never accepts a practice's notices for you and never confirms the appointment on its own. It hands you the next Doctolib page to finish yourself. Do not assume a write has been tested because it is listed. Check the status before you rely on it.
Your checklist
- Use recipes with
effect: "read"where possible. - Check the status of any write recipe in the registry before you use it.
- Keep the Allow window in view while the agent runs.
- Deny anything you did not ask for.
- If you manage a team, set Writes: deny unless members need writes.
FAQ
What happens if I close the browser?
The write does not run, because you did not click Allow. The agent gets a denial or a timeout. Run the task again when you are ready.
Can the agent click Allow for me?
No. The Allow window is shown in your browser and is answered by you. No agent, recipe or policy can answer it.
Does this protect me from every mistake?
It protects against writes you did not approve. It does not check that your approval was wise. Read each request before you click Allow, and keep a record of what you approved.
How do I see a worked example?
See how to get free Doctolib slots with Claude. It is a read-only task, and it explains how to book on the site yourself.