When Should an AI Agent Require Human Approval?

An AI agent should require human approval when an action is irreversible, moves money or data outside a trust boundary, or affects other people. Everything else, the reads, the queries, the drafts a person will send anyway, should run without a gate. The test is one question: if this action fired wrongly because of a bad plan or a prompt injection, could you take it back, and how much would it cost you before you did? If the answer is you could not, or it would cost a lot, put a human in front of it.

Getting this line right is what separates a safe agent from either a dangerous one or a useless one. Gate nothing and an autonomous agent will eventually issue a refund it should not have, delete records, or send data to the wrong place. Gate everything and you have rebuilt a slow manual process with extra steps. The skill is drawing the boundary narrowly and enforcing it reliably.

The rule: reversibility and blast radius

Two properties decide whether an action needs approval. Reversibility is whether you can undo it cleanly. Blast radius is how much harm a single wrong instance can cause. An action that is both irreversible and high blast radius always needs a human. An action that is reversible and low blast radius almost never does. The middle cases get decided by how much a single mistake costs. Grading actions this way is one line item on a broader AI agent hardening checklist.

Why the gate has to live outside the agent

It is tempting to solve this in the prompt: tell the agent to ask a human before doing anything risky. That does not hold, because the same manipulation that makes an agent take a bad action also talks it out of asking first. An agent under prompt injection will happily skip the approval step if the injected instructions tell it to. Approval that depends on the model choosing to comply is not a control.

The gate has to sit on the action path, in front of the agent, where it is enforced regardless of what the model decides. When the agent tries to call a tool you marked high-risk, execution pauses before the tool runs, a person sees the exact action and its inputs, and it proceeds only on an explicit approval. This is the difference between a suggestion and a boundary. It is the model we describe in human in the loop for AI agents.

Approval works best paired with least privilege

Human approval and least-privilege access are complementary. Least privilege shrinks the set of tools and data the agent can reach at all, so most dangerous actions are simply not available to it. Approval gates the small subset of reachable actions that are irreversible. Together they mean a hijacked agent has few dangerous tools, and the few it has cannot fire without a person. Use one without the other and you have gaps: broad access with approval means a long list of things to review, and narrow access without approval still lets an irreversible action run automatically. Scope first with AI agent access control, then gate what remains.

Concrete examples of where to draw the line

A support agent that reads orders and drafts replies needs no gate; a human sends the reply. The same agent, given the power to issue refunds, needs approval on the refund tool and nothing else. A finance agent that can move money or place a trade needs approval on every execution, because those actions clear irreversibly and the blast radius is your balance sheet. An internal research agent that only reads documents and writes summaries can run fully autonomously. A DevOps agent that can change infrastructure config needs approval on anything that alters permissions or deletes resources.

The pattern across all of these: approval attaches to specific tools, not to the agent as a whole. You are not choosing between an autonomous agent and a supervised one. You are marking the handful of tool calls that are too costly to leave to a machine, and letting the rest run at full speed.

Keep the record

Whatever line you draw, log both sides of it: every action that was held, and every approve or deny decision with who made it. That record is what lets you tune the boundary over time, prove to an auditor that a human reviewed the actions that mattered, and reconstruct what happened if something still goes wrong. Approval without an audit trail throws away the evidence you will want most.

Agentshield enforces human-in-the-loop approval on the actions you choose, in front of any agent framework, and records every held action and decision in an immutable trail. See how a gated action behaves against a live injection in the console above, then read human in the loop for AI agents for the full model.