"Shall We Approve?" Consequence-Aware Approval for Autonomous Coding Agents

Weiheng Wu, Junkai Chen, Zhensu Sun, Jieke SHI, Yunbo Lyu, David Lo

"Shall We Approve?" Consequence-Aware Approval for Autonomous Coding Agents: 11 upvotes on Hugging Face Daily Papers, #18 of 46 papers on 2026-11-04. Day-by-day upvote history.

Upvotes over time

It had 11 upvotes by its first day, 11 upvotes by the next day, 11 upvotes by day 3, 11 upvotes by day 7, and has 11 now. It ranked #57 of 130 papers in its week and #57 of 130 in its month. Its code repository has 4 GitHub stars.

Coding agents increasingly rely on automated approvers to decide whether a proposed shell command may run. Existing approvers, from rule-based checkers to guardrail models and deployed permission classifiers, base their decisions on the text of the request and command. Yet a command's behavior depends on the code it invokes and the state of the workspace, and systems that observe file changes leave the assessment to the agent or a human after execution. We present Caper, a consequence-aware approval mechanism that pre-executes each command in a snapshotted sandbox, provides an independent approver with a bounded report of its observed effects, commits allowed commands, and rolls back blocked ones with a reason the agent can act on. Compared with six existing systems, Caper achieves the lowest harmful-outcome rate on SABER (6.7% versus at least 14.8%) and YoloFS-Ext, a benchmark we build in which harmful behavior is hidden inside invoked tools (7.8% versus at least 35.3%), while blocking 1.0% of the safe twins of the dangerous tasks in YoloFS-Ext.

Paper page on Hugging Face · arXiv

Data: hysts-bot-data/daily-papers-stats and the Daily Papers API. Open data: tardellirs/paper-pulse-data. Sister project: Model Pulse, the download history of every model on the Hub.