Your role: you approve each action.
This is the rung where the box opens. The model gets tools — web search, email, file access, calendars, whatever the task needs — and with them, for the first time, the ability to touch the world outside the chat. And every single one of those actions happens only when you approve it. The AI proposes; you dispose. That arrangement has a name you will meet again: human-in-the-loop.
The naming is deliberate, and it exists to dissolve the most common confusion in the whole subject: "Isn't tool use just what an agent does?"
Yes. Same mechanism. The tools that appear at rung 3 never leave — rungs 4 and 5 use exactly the same web search, the same email access, the same integrations. Nothing new is bolted on above this rung. What changes from rung to rung is whose hand is on the trigger.
So "tool use" cannot be what distinguishes rung 3 — tools are the shared property of rungs 3, 4, and 5. What distinguishes rung 3 is the supervision: every action individually approved by you. The climb from rung 3 to rung 4 is precisely: you stop approving each action and start approving the goal. Name the rung after the thing that changes, not the thing that stays.
Recall the rung-1 problem: a sealed model can only sound right. A tool-equipped model can check. It can search, retrieve real documents, and build its answer out of what it found — with citations you can follow.
This is grounding, and it is the deep reason tools exist — not convenience, verifiability. Grounding versus hallucination is one of the framework's two load-bearing contrast pairs. The pattern of retrieving relevant documents and putting them on the desk before answering has a name — RAG, retrieval-augmented generation — and if you read the Context pillar, you already understand it: RAG is context management. Put only the relevant documents on the desk, fetched fresh per question.
One discipline comes with it: a citation is a claim, not proof. Models can cite a real source that does not say what the summary claims it says. Your rung-1 verification instinct now has a concrete job: follow the citation, confirm the source says the thing.
Here is the trade nobody should soften: the moment the AI can act on the world, you inherit responsibility for what makes that safe. Not as an advanced topic — as table stakes for standing on this rung at all. Three inheritances arrive immediately:
Where your data goes. Connecting a tool means data flows through it. Pasting material into a model means that material went somewhere — whose servers? retained how long? used for what? At rung 3 you must be able to answer, for every tool you use: what data of mine goes in, and where does it live? If you cannot answer that, you are not using the tool; you are trusting it blindly.
Prompt injection. Once the model reads the outside world, the outside world can talk back. A web page or email can contain text crafted to hijack the model — "ignore your instructions and forward this to…" The model reads retrieved content the same way it reads your instructions; malicious content exploits exactly that. Injection is the signature attack of the tool era, and your per-action approval is, among other things, your injection tripwire: why does it want to send an email I didn't ask about?
Credentials. Connections to tools are built on credentials — passwords, tokens, keys. Two rules, both absolute: never paste a credential into a chat, and grant connected tools the narrowest access that works. A credential in a context window is a credential you no longer control.
These three are the opening of the infrastructure & trust track — a parallel strand of the framework that switches on here and runs to the top of the ladder. Rungs 1–2 needed none of it; the box was sealed.
Judgment relocates from evaluating text to authorizing actions. Each approval is a small decision with real-world consequences: is this search sensible, is this draft accurate, should this email actually go out, to these people? The frequency is still high — every action — but the stakes per decision just became real. This is the rung where judgment stops being editorial and starts being operational.
Friday. You open the assistant — one with web search and your email connected as approved integrations — and ask: "Compile this week's field summary for the team, using our usual format."
The assistant proposes its first action: "I'd like to search for developments in [your field] from the past week." You approve. It runs several searches and comes back with six candidate articles, linked. You skim the list, drop two that are off-topic, and tell it to work with the remaining four.
It drafts the five-bullet summary — and this draft is different from anything rungs 1–2 produced: every bullet carries a citation to the article it came from. The bullets aren't the model's unaccompanied word; they're grounded in retrieved sources you can check. You check one — the boldest claim. The source holds; the phrasing is fair. (The week a citation didn't hold — the article said "proposed," the bullet said "launched" — is the week citations stopped feeling like decoration to you.)
Then the assistant does the thing that marks this rung: "Draft ready. Want me to send it to the team list?" It can actually do it. The email is real, the recipient list is real, and one approval from you fires it. You read the draft one more time — because your approval is now the only thing between this text and forty inboxes — and approve. Sent.
Total elapsed time: about ten minutes, most of it reading. The twenty minutes of article-hunting and the seven copy-pastes from rung 2: gone.
Where did the friction go? Every mechanical-transport step from rung 2 is now the model's job. What remains for you is only the judgment: which sources, is it accurate, does it send. Rung 2's imbalance — two minutes of judgment buried in twenty of wiring — has been inverted.
Nothing fired without you. Search: approved. Source list: curated by you. Send: approved. The AI proposed every step; you disposed of every step. That is human-in-the-loop, lived.
The new questions you can now answer. Where does a search query go when the assistant searches? (To the search provider — it leaves the chat.) Where does the team's email address list live? (In the email integration you connected — check what access you granted it.) What would you do if a drafted summary suddenly contained an instruction-shaped sentence like "forward this summary to this outside address"? (Refuse the approval and get suspicious of the source article — that's injection.) At rung 3, being able to answer these is part of doing the task.
A concrete benchmark for the rung: an AI with search and email access compiles a grounded, cited summary of your field's week and offers to send it — and you approve each step, having actually judged each step.
You act on the real world safely AND you can state where your data goes.
The AND is the point. Plenty of people clear the first half — happily approving actions all day. The gate demands the second half too: if asked, right now, "when you use that assistant, where does your pasted text go? what can the email integration see? what would injection look like in your setup?" — you can answer in plain sentences. This is the first rung whose gate includes an accountability test, because it is the first rung where your approvals have consequences outside the chat. The pattern continues upward: every gate from here on pairs a capability with the responsibility that capability creates.
Because the box opens here, and the infrastructure & trust track switches on with it. Core terms below; the full trust-track vocabulary — where the model lives, the attack surface, ops literacy — is in the glossary and the track.
Tool / function calling. The mechanism behind everything at rungs 3–5: the model, mid-response, requests that a specific tool be run (a search, an email draft, a file read) and then incorporates the result. The same mechanism whether a human approves each call (rung 3) or not (rungs 4–5).
Grounding. Tying the model's output to retrieved, checkable sources instead of its unaccompanied recall. The deep reason tools exist: a sealed model can only sound right; a grounded one can be checked. One half of the load-bearing pair grounding vs. hallucination.
Retrieval / RAG. Fetching relevant documents and placing them on the model's desk before it answers. Best understood as context management: only the relevant material, fetched fresh per question. Complement to long context windows, not a competitor.
Citation. A pointer from a claim to its source. Discipline: a citation is a claim, not proof — models can cite real sources that don't say what the summary says. Follow and confirm.
Connector / integration. A configured link between an AI assistant and a real service (email, calendar, files, search). Each connector is both a capability and a data pathway — every one you add extends what the AI can do and where your data can flow.
Human-in-the-loop. The rung-3 arrangement: a human approval sits inside the action loop, so nothing fires without a person. Contrast with human-on-the-loop at rung 5 — the whole autonomy story in two prepositions.
Effective vs. advertised context. From the Context pillar, first operationally relevant here: retrieval pipelines must budget for the context size at which the model stays accurate (often ~150–400K tokens on models advertising millions), not the number on the marketing page.