It generally can't do that. Internally it's a pure function that emits effects through tool calls and than those effects are applied by the deterministic harness. Making sure that tool calls are guarded by a prompt is as trivial as guarding the normal button press with the tool.

You can get fancy of course and have a second LLM with a different context window to act give another confirmation based on the explaination made the first one (the standard four eye rule).