Introduction

When an AI agent is about to send a message, make a payment, or delete something, one layer of protection isn’t enough.

StareBrain uses two independent checks before any risky action reaches the user for confirmation: the LLM’s own requires_confirmation flag in the response, and a client-side keyword guard that runs regardless of what the LLM said.

Neither layer trusts the other. That’s the point.

Why Two Layers

The LLM decides requires_confirmation based on its understanding of the action. Most of the time it gets this right. But LLMs can be wrong — a prompt that’s slightly unusual, a new action type the model hasn’t seen in context, a subtle misclassification. If the only gate is the model’s own judgment, a missed classification means an unconfirmed destructive action goes through.

The keyword guard is dumb by design. It doesn’t understand the action — it just scans the button label or action text for known risky patterns. It can’t be confused by context. It doesn’t hallucinate.…