how to add human approval to AI agents

To add human approval to AI agents, pause the workflow before a consequential action, save the proposed action and its context, and ask an authorized reviewer to approve, edit, or reject it. Resume only after validating that decision against the exact action, current permissions, and an expiration policy.

Key takeaways

• Enforce approval in the execution layer, not just in the agent’s prompt.
• Require review for consequential actions such as payments, deletions, permission changes, and external messages.
• Store pending requests durably so restarts, timeouts, and retries cannot bypass approval.
• Bind every approval to a specific action version, reviewer identity, and expiration time.
• Start with a managed automation platform or a durable agent workflow, then measure reviewer workload before expanding autonomy.

What does human approval actually mean for an AI agent?

Human approval is a control that prevents an agent from executing a protected action until an authorized person permits it. The model can research, draft, and recommend independently, but it cannot cross the execution boundary on its own.

For example, a customer-support agent might read a Stripe payment record and propose a refund. It creates a pending refund request instead of calling the refund API. Your backend executes that request only after a reviewer approves it.

Separate planning from execution

1. Propose: The agent generates a structured action, including the target, parameters, and reason.
2. Pause: Your application saves the proposal and stops execution.
3. Review: A person approves, edits, or rejects the request.
4. Validate: The backend checks identity, permissions, action version, and freshness.
5. Execute: A restricted worker performs the approved action and records the outcome.

Use PostgreSQL to store requests and a backend worker to execute them. For a small prototype, budget roughly $25–$100 per month for hosting and database services, excluding model usage and labor; this is a planning allowance, not a vendor quote.

The main pitfall is telling the model, “Always ask permission,” while still giving it unrestricted tools. Instructions guide behavior; authorization checks enforce boundaries.

Which AI agent actions should require human approval?

Classify actions by impact, reversibility, and data sensitivity. A read-only search usually needs fewer controls than sending an email, deleting records, or changing access permissions. Reading sensitive information still requires proper authorization, even when no approval screen appears.

Create a practical risk policy

• Low risk: Search approved documentation, summarize accessible records, or prepare drafts.
• Moderate risk: Update reversible internal fields within narrowly defined limits.
• High risk: Send external messages, issue refunds, publish content, or export customer data.
• Critical risk: Change administrator access, delete production data, or initiate substantial payments.

Implement the policy in application code or a policy engine such as Open Policy Agent. Evaluate the tool name, user role, destination, amount, data classification, and recent activity before permitting execution.

A startup might choose approval for every refund during its pilot, then allow small refunds under a documented policy. Those thresholds are business decisions, not universal safety standards. Add cumulative limits so multiple small actions cannot evade a larger transaction threshold.

For a first implementation, allow roughly one to three engineering days to inventory tools, define policies, and write basic tests. Complex permissions take longer.

For US-facing marketing agents, add checks for applicable FTC affiliate disclosures before publication. Human approval does not replace those requirements. The common mistake is classifying risk solely by dollar value while overlooking privacy, reputation, and legal consequences.

Which tools can add approval steps to an AI workflow?

Choose tools based on where the workflow runs and how long approval might take. A simple internal automation can use a managed platform. A customer-facing AI product usually needs stronger control over identity, persistence, and execution.

Check current vendor pricing before choosing a plan. For planning, a lightweight internal workflow might need $50–$200 per month across automation, hosting, and model usage. That range is not a production quote and excludes reviewer time.

Choose the smallest reliable stack

1. Use n8n or Power Automate when the surrounding process already lives there.
2. Use LangGraph when your application needs agent-state interrupts and controlled resumption.
3. Consider Temporal when workflows must survive extended waits, retries, and service failures.

The pitfall is assuming a pause feature provides complete approval security. You still need reviewer authorization, action binding, expiration, and duplicate-execution protection.

How do you implement a secure approval gate step by step?

Put the gate in front of the protected tool. The agent should call a proposal function such as request_refund, while only a restricted backend worker can access the actual Stripe refund operation.

Store a durable approval record

At minimum, save these fields in PostgreSQL or another transactional database:

• Request ID, workflow ID, and tenant ID.
• Tool name, validated arguments, and action version or payload hash.
• Initiating user and eligible reviewer identities or roles.
• Status, creation time, expiration time, and decision time.
• Reviewer identity, decision, comments, and execution result.

Enforce the transition to execution

1. Validate the proposal: Use JSON Schema or Pydantic to reject malformed arguments and unsupported operations.
2. Save before notifying: Commit the pending request before sending a Slack message or email.
3. Authenticate the reviewer: Use your application login or an identity provider such as Auth0 or Microsoft Entra ID.
4. Check authorization: Confirm tenant membership, reviewer role, and any separation-of-duties requirement.
5. Bind the decision: Accept approval only for the stored action version.
6. Claim execution atomically: Transition the approved request to executing so competing workers cannot both claim it.
7. Revalidate and execute: Check current permissions and relevant business state, then call the tool.

If a reviewer edits the recipient, refund amount, or message body, create a new action version. Require explicit approval of that revised version; never carry the old approval forward silently.

Allow approximately three to seven engineering days for a narrow custom implementation with authentication and tests. Complex multitenancy or compliance requirements can substantially increase that estimate. The biggest pitfall is leaving a second, unprotected execution path available to the agent.

How should Slack, email, and dashboard approvals work?

Use notifications to bring reviewers to a trustworthy decision surface. A dashboard is often best for sensitive actions because it can display full context, enforce login, and show whether the request has changed or expired.

Show what the reviewer is actually approving

• Action: “Refund $84 to payment ending in 4821.”
• Target: The customer, account, destination, or record affected.
• Reason: A short explanation grounded in relevant source material.
• Impact: Whether the operation is reversible and what happens next.
• Changes: A diff for edited records, messages, or permissions.
• Controls: Approve, reject, or revise, plus expiration status.

For Slack interactions, verify request signatures and map the Slack user to an authorized application identity. For email, prefer a link to an authenticated page. Do not execute an action merely because someone opened a URL: email security scanners can follow links automatically.

Build a simple review interface with Retool or your existing React application. Retool licensing may add per-user costs; using an existing frontend avoids another platform subscription but still requires development and maintenance.

Start by budgeting one to three engineering days for a basic queue and detail screen. Avoid exposing secrets or unnecessary personal information in notifications. Treat text retrieved by the agent as untrusted content, and keep it visually separate from system-generated action details.

How do you handle timeouts, retries, and approval fatigue?

A production workflow must remain safe when nobody responds, a worker restarts, or an API call times out. Default to no execution when approval is missing, expired, or ambiguous.

Design explicit failure behavior

1. Expire requests: Choose a lifetime appropriate to the action. Time-sensitive prices or account states may become stale quickly.
2. Escalate safely: Notify a backup reviewer instead of treating silence as consent.
3. Use idempotency: Pass a stable idempotency key to APIs that support it, including relevant Stripe operations.
4. Reconcile uncertainty: If a call times out, check the provider’s recorded result before retrying.
5. Recheck state: Stop if the approved operation is no longer valid, even if approval has not expired.

Database locking prevents two workers from claiming the same request, but it does not guarantee exactly-once behavior across an external API. Provider idempotency and reconciliation address that separate failure boundary.

Test the bypasses, not just the happy path

Use pytest or your normal test framework to cover unauthorized reviewers, cross-tenant access, edited payloads, duplicate clicks, expired requests, worker crashes, and tool-output prompt injection. OpenTelemetry can help trace the proposal, decision, and execution without logging sensitive payloads unnecessarily.

Reserve roughly two to five engineering days for failure-path testing in a small system. Track review time, rejection rate, and repeated low-value requests before reducing approvals. Batch only related, clearly enumerated actions; approving an open-ended instruction such as “finish all account cleanup” creates excessive authority.

Frequently asked questions

Can I add human approval with only a system prompt?

No. A prompt can tell an agent to request permission, but a backend control must prevent protected tools from running without valid approval.

Does every AI agent action need approval?

No. Keep low-risk operations autonomous within defined permissions, and require review where consequences justify it. Too many unnecessary requests can cause reviewers to approve without careful inspection.

Can an agent continue working while approval is pending?

Yes, if the parallel work is independent and permitted. Keep the protected branch paused, and do not allow other branches to change the approved payload or create conflicting side effects.

What should happen when a reviewer rejects an action?

Record the rejection and stop that proposed action. The agent may prepare a revised proposal within policy, but it should not repeatedly resubmit the same request or seek a less restrictive reviewer.

Is human approval enough for regulated workflows?

No. Approval is one control alongside access restrictions, data handling, audit records, retention policies, and applicable legal requirements. Have qualified security and compliance specialists review workflows involving regulated data or consequential decisions.

Muhammad Tariq at Tariq Services builds AI products, agents, and automations with practical approval controls. Explore our AI development services if you need help designing a workflow that keeps consequential actions under human control.