Human-in-the-Loop Approval for AI Actions

Choose actions that require approval

Inventory agent actions and classify impact, reversibility, affected parties, data sensitivity, and required organizational authority. Sending an internal draft to its author differs from sending a notice to thousands of customers. Approval is especially important for money movement, deletion, publication, access changes, external communication, and decisions affecting people's opportunities or rights.

Do not ask the model to decide whether oversight is necessary based on its confidence. The application should map tool and parameter combinations to a policy. Some calls can execute automatically within narrow limits; others always pause. Prohibited actions should remain unavailable rather than appearing as options a reviewer can approve informally.

Create an informed preview

The reviewer needs a concrete representation of what will happen: recipient, resource, exact content, amount, scope, timing, and whether reversal is possible. Show supporting evidence and highlight fields inferred or missing. A generic approve agent plan button hides too much. For edits, display a meaningful change comparison rather than only the resulting document.

The interface should identify why approval is required and who has authority. Offer reject, revise, and request-more-information paths. Avoid default selections and repetitive prompts that train people to click through. Group low-risk homogeneous actions only when the reviewer can still understand the set and exclusions clearly.

Bind approval to execution

Generate an immutable action proposal with a stable identifier and hash of consequential parameters. The approval record names the reviewer, role, decision, time, and proposal version. If the content, recipient, amount, or target changes, create a new proposal. A model should never edit an approved payload before sending it.

At execution, check that approval is current, the reviewer still has authority, the resource is unchanged, and policy limits still pass. Use an idempotency key so retries do not duplicate the action. Expire approvals after a suitable period and after material context changes. Return the actual tool result to the workflow instead of assuming approval means success.

Measure oversight quality

Track approval, rejection, revision, expiration, and post-action correction rates by action type. Review whether rejected proposals share a cause the workflow can fix. Very high approval with extremely short review times may signal poor presentation or alert fatigue, not excellent agent quality. Interview reviewers about what information they lack.

Test bypass attempts, stale links, changed payloads, duplicate clicks, removed reviewer permissions, and unavailable downstream systems. Include untrusted content that tells the agent approval is unnecessary. Consult current platform guidance quarterly for implementation capabilities, while keeping approval policy in application code and organizational governance rather than in generated instructions.

Approve a customer service credit

An agent recommends a service credit after reading a complaint and account history.

1. Use policy code to determine that credits above the agent's zero-dollar authority require an authorized support lead.
2. Create a proposal showing customer, exact amount, reason, cited account events, policy limit, and the message that will be sent.
3. Let the lead approve, reject, or edit; any edit creates a new version with its own validated amount and message preview.
4. Before execution, recheck account status, lead authority, proposal expiration, and idempotency key, then call the narrow issue-credit tool.
5. Record the actual payment-system result and expose failures for repair rather than marking the case complete from the approval alone.

Approval control specification

Define these elements for each action class that can pause for a person.

• Trigger: impact, amount, data class, recipient, reversibility, and policy reason.
• Reviewer: required role, separation of duties, delegation, and authority recheck.
• Preview: exact payload, affected resource, evidence, unknowns, and expected consequence.
• Binding: proposal identifier, protected fields, expiration, version change, and idempotency.
• Outcome: execute, reject, revise, fail, recover, audit, and notify behavior.

Common mistakes

• Showing reviewers a broad plan instead of the exact message, record change, recipient, or amount to be executed.
• Reusing approval after the agent changes consequential parameters or after the underlying resource changes.
• Adding approval to every minor action until reviewers stop examining the proposals that carry real risk.

Try one

Sources

• OpenAI safety best practicesOfficial recommendations for testing, constraints, and human oversight.
• OWASP Top 10 for Large Language Model ApplicationsOfficial OWASP project covering major security risks in applications that use language models.