A reference architecture where agents structurally cannot authorize their own actions.

decionis/agent-safe-pipeline (269 stars, Apache-2.0) splits agent action into immutable intent capture, an independent ALLOW/ESCALATE/BLOCK policy verdict, verified human approval, and a SafeExecutor consuming a single-use grant bound to that specific intent. The agent never holds the authorization capability at any point, which is a stronger property than the confirm-dialog pattern most frameworks ship. It's a reference architecture, not a runtime, so plan to port the pattern.