arxiv:2610.40753

"Shall We Approve?" Consequence-Aware Approval for Autonomous Coding Agents

Published on Oct 29

· Submitted by

Weiheng Wu on Nov 4

Singapore Management University

Upvote

Authors:

Weiheng Wu ,

Zhensu Sun ,

Jieke Shi ,

Abstract

Caper pre-executes shell commands in isolated sandboxes to evaluate real-world effects before approval, reducing harmful outcomes compared to text-based approvers.

Generated by thinkingmachines/Inkling-Small

Coding agents increasingly rely on automated approvers to decide whether a proposed shell command may run. Existing approvers, from rule-based checkers to guardrail models and deployed permission classifiers, base their decisions on the text of the request and command. Yet a command's behavior depends on the code it invokes and the state of the workspace, and systems that observe file changes leave the assessment to the agent or a human after execution. We present Caper, a consequence-aware approval mechanism that pre-executes each command in a snapshotted sandbox, provides an independent approver with a bounded report of its observed effects, commits allowed commands, and rolls back blocked ones with a reason the agent can act on. Compared with six existing systems, Caper achieves the lowest harmful-outcome rate on SABER (6.7% versus at least 14.8%) and YoloFS-Ext, a benchmark we build in which harmful behavior is hidden inside invoked tools (7.8% versus at least 35.3%), while blocking 1.0% of the safe twins of the dangerous tasks in YoloFS-Ext.

View arXiv page View PDF GitHub 4 Add to collection

Community

WWeiheng

Paper author Paper submitter 1 day ago

Does a coding agent really know what its next command will do?

Approving every command by hand does not scale: Claude Code users approve 93% of permission prompts anyway. So agents now rely on automated approvers, such as Claude Code's Auto Mode, rule-based checkers, and guardrail models. All of them judge the text of the command. Yet a command's behavior is decided by the scripts it invokes and the workspace it runs in, and the same command can be harmless in one project and destructive in another.

We propose Caper, which approves a command after seeing what it does. Each command is pre-executed in a snapshotted sandbox under system-call tracing. An LLM approver reviews a compact report of the observed effects: file changes, network attempts, and reads of secrets. Allowed commands are committed; blocked ones are rolled back, and the agent gets a reason it can act on.

Compared with six existing systems, Caper has the lowest harmful-outcome rate on SABER (6.7% vs. at least 14.8%) and on YoloFS-Ext, our benchmark that hides harm inside the tools agents are asked to run (7.8% vs. at least 35.3%). It blocks only 1.0% of the safe twins.

Code and data: https://github.com/wudaoz/Caper