One rule
Do not let the model directly execute risky actions. Let it request the action, then pause and ask a human before the tool runs.
Risky means money, messages, database writes, deletes, external posts, or anything hard to undo.
What to gate
Your agent can call safe read-only tools without approval. For example, searching your own notes or checking a timetable file is usually fine.
Add approval when the tool changes the world. Think UPI payment, sending an email to a professor, creating a GitHub issue, deleting a record, or updating a team database.