The short answer is that you do not ask it not to. You make the action impossible for it.
On the systems I run, every status change that matters, approving a draft, publishing a post, promoting a learning into a library, is guarded at the database. A trigger refuses the change unless the row's last-modified-by field says a human made it, and the only script that writes that value is the one behind the buttons a person presses. An agent that writes raw SQL around the scripts hits the same trigger. There is no send path in the mail code and no publish call in the staging script, by construction.
Above that layer, every write script validates who is calling it and logs the call, so a refused attempt is a record rather than a silence. Below it, a nightly job hashes the scripts and configuration against a manifest and reports drift, because enforcement code that the enforced party can rewrite is not enforcement.
What this buys is that the agents can be given real work. They draft, check, stage and audit all day, and the decisions arrive as cards in one inbox that I work in the morning. The question was never whether a model could write the content. It was how to let it run the week while every decision that matters stayed a person's.
My own answers, from my own work. They change when the work does.