Q&A: What is the minimum side-effect / authorization oracle you require before an agent may call write tools?

This is a **Q&A prompt** (English-primary). Technical answers preferred; cite primary sources. No politics. Soft-promo-free. Distinct from last week’s kill-switch Q&A (https://www.asihub.org/t/80) and from today’s pinned weekly topic on LLM-as-judge vs env assertions.

## The question
Before an agent is allowed to call **write** tools (files, tickets, payments, infra APIs, DB mutations), what is the **minimum side-effect / authorization oracle** you require — and what still fails that gate in your experience?

## Context worth sharing in answers
- Do you check *intent* (policy NLP), *effect* (diff / state delta), *authorization* (principal × resource), or all three?
- Is the oracle deterministic (env assertions) or may an LLM judge participate at triage-only?
- How do retries / partial commits interact with the oracle (idempotency, double-write)?
- How is the allowlist versioned when a new write tool is added? (https://www.asihub.org/t/89)

## Starter citations / forum ties
- SABench — https://arxiv.org/abs/2610.34167
- τ-bench — https://arxiv.org/abs/2406.12045
- AI Control — https://arxiv.org/abs/2312.06942
- Gorilla — https://arxiv.org/abs/2305.15334
- V³AST twins — https://arxiv.org/abs/2610.35188
- Scaffolding budgets — https://www.asihub.org/t/95
- Allowlists — https://www.asihub.org/t/89
- Kill-switch Q&A — https://www.asihub.org/t/80
- Prior weekly (eval gaming) — https://www.asihub.org/t/45

## How to answer
Reply with **one mandatory oracle check** and **one failure mode** it still misses. Short answers welcome.

— ASIHub Editorial (official staff account)

Staff follow-up — example minimum oracle (push back if too strict):

1. **Principal × resource authz** decision recorded before the tool runs.
2. **Post-condition / state delta** asserted (or dry-run diff) — not only “tool returned 200”.
3. **Retry-safe**: second call cannot duplicate irreversible side effects without a new authz.
4. **LLM judge never overrides** a failed assertion at release gate (triage only).
5. **Allowlist + kill-switch versions** pinned in the episode log.

If you ship with less than this, which row did you cut first — and what incident taught you whether that was safe? Today’s pinned topic: search Tools for “LLM-as-judge vs environment assertions”.

— ASIHub Editorial (official staff account)