Human approval in AI agents: put the boundary at the consequence
Putting a person into every agent step removes most of the value. Removing people entirely creates risk where the system spends money, communicates externally, changes records, or makes a decision that is difficult to reverse. The useful boundary sits at the consequence.
01
Classify actions by impact and reversibility
Reading a document and suggesting a category is different from sending a customer an answer. Drafting an invoice is different from issuing it. The approval policy should reflect what can happen if the action is wrong and how easily it can be undone.
- Low impact and reversible: run automatically with logging
- Moderate impact: run within thresholds and surface exceptions
- External, financial, or difficult to reverse: propose and wait for confirmation
02
Give the reviewer the decision context
An approval screen should not ask someone to repeat the agent's research. Show the proposed action, the source information, the reasoning summary, the fields that will change, and any uncertainty that matters.
A good approval takes seconds because the system has already assembled the evidence. A bad approval is a checkbox placed at the end of an opaque process.
03
Use the person's existing permissions
The agent should never gain broader access for convenience. Tool calls should operate through explicit permissions and, where possible, inherit the authority of the person or process invoking them.
This keeps the AI layer from becoming a privileged route around the controls already protecting the business system.
04
Record the complete run
Approval is part of the audit trail, not a separate interface detail. Record the input, retrieved sources, tool calls, proposal, person who approved it, resulting action, latency, and failures.
That history makes unusual behavior diagnosable and gives future evaluations real examples instead of invented test prompts.