An agent built with the Claude Agent SDK can issue customer refunds through a custom tool. Refunds cannot be reversed, so the business requires a human to approve each one before it runs, while read-only lookup tools should continue without interruption. What is the most reliable way to enforce this?