Put human approval where an AI agent crosses into the real world
Design human-in-the-loop AI agents with risk-based approval gates, clear evidence, editable drafts, timeouts, escalation, and auditable decisions.
Human-in-the-loop design should gate the transition from analysis to consequence. Ask for approval immediately before a customer message, payment, publish, deletion, order, permission change, or other high-impact write, and show the evidence and exact proposed action.
Choose gates by consequence
Do not interrupt every read or formatting step. Gate actions based on reversibility, audience, financial impact, legal effect, ambiguity, and confidence in the underlying state. The person should decide at the last safe moment before execution.
Make approval informed
An Approve button without context is ceremony. Show the source evidence, exact destination, proposed payload, affected records, expected side effects, and alternatives. Let the reviewer edit a draft when editing is safer than restarting the entire run.
- Approve, reject, and edit choices
- Timeout and escalation behavior
- Identity and timestamp of the reviewer
- Immutable link to the proposed action and evidence
- No silent continuation after an expired approval
Measure the gate
Track rejection reasons, edit distance, time to decision, repeated requests, and post-approval corrections. High rejection or heavy editing means the upstream agent or context needs work. Low rejection does not prove the gate is useful if reviewers are rubber-stamping unclear requests.
Frequently asked questions
What agent actions should require human approval?
Customer-facing messages, publishing, payments, trades, deletions, permission changes, sensitive-data transfers, and other consequential or difficult-to-reverse writes are strong candidates.
Does human approval make an agent safe?
It reduces risk but is not sufficient alone. Permissions, validation, clear evidence, reviewer training, and containment still matter.
Can an approval be edited?
For draftable actions, editable approval is often better than a binary choice. The final executed payload and the reviewer change should both be recorded.
