Romeo can take real actions on your machine, which means we had to decide, concretely, what it is never allowed to do without a human confirming first. The list is shorter than you would expect, but every item on it was earned the hard way in testing.
Anything irreversible — deleting data, sending a message on your behalf, moving money — requires an explicit confirmation step, shown in plain language, before it happens. Anything reversible or read-only, Romeo can just do.
The harder engineering problem was not the confirmation step itself, but classifying actions correctly in the first place — a lot of things that look read-only (like "check the calendar") can trigger side effects (like a calendar app auto-sending an RSVP) that are not obvious from the tool call alone.
We would rather Romeo ask one extra question than get this wrong once.