← Reference · Nestor G Pestelos Jr

Software Architecture · AI Safety

Plan-Approve-Execute

Reference entry · last updated August 25, 2026

Plan-approve-execute is a control-plane pattern for autonomous software agents that divides task processing into an exploratory planning phase, an explicit human or policy approval gate, and an isolated execution phase.[1] By disallowing unconstrained side effects during reasoning loops, the pattern constrains excessive agency and bounds the blast radius of agent errors.[2]

Excessive agency risks

Autonomous LLM agents operating in ReAct (Reason + Act) loops generate tool calls dynamically based on conversational context. When agents are granted direct access to destructive tools (such as file modifications, shell execution, or financial transactions), hallucinations or prompt injections can trigger catastrophic unauthorized mutations.[2]

Excessive agency manifests in two primary failure modes:

• Unintended tool cascading: A minor error in an intermediate reasoning step prompts the agent to attempt destructive rollbacks (such as dropping database tables or deleting files) to fix the issue.
• Side-effect sprawl: Mutating shared external state before verifying whether the proposed solution satisfies the original requirement.

Three-phase lifecycle

The pattern enforces three distinct operational boundaries:[1]

1. Plan generation (read-only): The agent inspects documentation, searches codebases, and produces a structured, human-readable execution plan. No mutating tools are available during this phase.
2. Approval gate (policy checkpoint): The generated plan is presented to a human operator or an automated policy validator. The system remains blocked until explicit approval is registered.[3]
3. Deterministic execution (authorized write): The system executes only the specific actions detailed in the approved plan. Any deviation or unlisted tool call triggers an immediate fault.

Tool classification and sandboxing

Systems implement role-based access control (RBAC) over agent tooling by categorizing tools into tiered risk classes:[1]

• Safe / read-only tools: Directory listing, file reading, semantic search, and web fetching. Freely accessible during planning.
• Idempotent mutation tools: Ephemeral scratchpad writes and local sandbox execution. Subject to automated quotas.
• Destructive / high-blast-radius tools: Production database updates, external API webhooks, git pushes, and file deletions. Strictly gated behind authorization checkpoints.[2]

Integration with fail-closed control planes

Plan-approve-execute operationalizes the fail-closed security principle. If an approval token expires, a network partition occurs, or an ambiguity arises during execution, the agent terminates execution immediately rather than guessing.[3]

See also

• Fail-closed
• Agents
• TOCTOU race condition
• Plan-Approve-Execute (ELI5 explainer)

References

1. ↑ Mitra, Sampriti. System Design for the LLM Era: Patterns and Principles for Production-Grade AI Architecture. Packt Publishing, 2026. Ch. 2: "Core Architectural Patterns for LLM System Design."
2. ↑ OWASP Foundation. "OWASP Top 10 for Large Language Model Applications," 2025. Item LLM08: Excessive Agency.
3. ↑ Shinn, N., et al. "Reflexion: Language Agents with Verbal Reinforcement Learning." NeurIPS, 2023.