Outlining the actions could get tricky in practice, though, if people don't dive into the definition and parameters of every "action" their LLM suggests. Let's say the "actions" are bundled up in third party "apps" or whatever. Sending email is pretty straightforward, but we'll eventually get more complicated ones, many of which will be legitimate, but some could be malicious (or replaced over time with malicious versions). There's a risk people will get used to just rubber stamping unfamiliar actions if they sound plausible.

There are also parameters: the text of the email to send is an obvious one, but other actions could be less obvious, and an evil prompt could induce a user to approve bad parameters to an action that's usually fine.