Every serious conversation about agents in a working codebase arrives at the same question, usually from somebody in security rather than engineering. An agent did something consequential. Who is accountable for that?
The comfortable answer is that a human approved it. That answer is only worth anything if you can demonstrate it afterwards, which turns a philosophical question into an engineering requirement.
The permission pause is the accountability mechanism
It is easy to read permission requests as friction, and there is a whole genre of tooling premised on removing them. But the pause is doing real work: it is the point where a decision gets attached to a person.
Remove it and you have not made the agent smarter, you have removed the only place a human decision was recorded. That is a governance regression dressed up as a productivity gain.
Supervision that leaves no trace is indistinguishable from no supervision, six months later when somebody asks.
What an audit record has to carry
For an approval to be meaningful in review, three things have to survive: who decided, what they decided about, and when. That sounds obvious, and it is routinely got wrong in ways that matter.
- The actor has to be a person, not a service account that everybody shares.
- The target has to identify the specific session and request, not just the day it happened.
- The timestamp has to come from the system rather than from a client that can be wrong.
- The record has to be identical regardless of where the decision was made from.
That last point is the one people miss when they add remote capability to something. If approving from a phone produces a thinner record than approving at a keyboard, you have created a hole and an incentive to use it.
Why this shapes the architecture
A control plane is well placed to do this, because every decision already passes through it. The request is relayed out, the answer comes back, and both ends are observed by the same system that knows which member of which organization is acting.
It also constrains what we can honestly claim. An audit log tells you an approval happened and who made it. It does not tell you the approval was wise, and no amount of logging makes an approved mistake stop being a mistake.
The unflattering part
Audit logging is a detection and accountability control, not a prevention control. If somebody with a legitimate seat approves something they should not have, the record is how you find out afterwards. Nothing about it stops the action.
We would rather say that plainly than let anybody buy this expecting it to prevent bad decisions. What it prevents is the much worse situation where a bad decision has no name attached to it at all.