Should AI agents have to declare what they’re about to do before they act?

I have been thinking about a failure mode that permissions alone don’t really solve.

An agent might correctly decide:

“Refund this customer $25.”

But the actual tool call could end up being:

• $250 instead of $25

• the wrong customer

• the wrong payment method

• multiple refunds instead of one

The reasoning may be fine.

The execution may not be.

So perhaps consequential agent actions need an intermediate step where the agent produces a structured intent before calling the tool.

Something like:

• What action am I taking?

• Who or what am I acting on?

• What exactly will change?

• What evidence am I using?

• What parameters should be sent?

Then the system can compare that intent with the actual tool call before execution.

That creates an interesting distinction:

“Is the agent allowed to do this?”

vs.

“Is the agent actually doing what it decided to do?”

Those are not necessarily the same problem.

Of course, doing this for every tiny action would add unnecessary overhead.

But for consequential actions, validating the gap between intent and execution might catch a class of failures that normal permission systems miss.

For people building agents with real tool access:

Are you validating the agent’s intended action against the actual tool call?

And have you seen cases where the reasoning was correct, but the execution parameters were wrong?