Human-in-the-loop approval

What it is

Some actions should never run on a model's say-so: paying a supplier, deleting a user, emailing every customer. Human-in-the-loop approval puts a person between the agent's decision and the action. The MCP tools specification says that for trust and safety there should always be a human in the loop with the ability to deny tool invocations. The OWASP Top 10 for LLM applications recommends human approval for high-impact actions as a mitigation for excessive agency.

Why it matters

Approvals contain the damage from both mistakes and manipulation. A prompt-injected agent that tries to export a customer list stops at the approval. Regulation points the same way: Article 14 of the EU AI Act requires high-risk AI systems to be designed so that people can oversee them, override their output and interrupt them.

How it works

1. Decide what needs approval. Usually writes with financial, security or irreversible effect, not every read.
2. Bind the approval to the exact action. OWASP's agent cheat sheet says approval must be tied to the specific action and arguments, and decision kept separate from execution.
3. Suspend the run and tell a named approver what is waiting.
4. Record the decision, who made it and when.
5. Resume or stop the run exactly where it paused.

Example

An IT agent processing a leaver can disable the account and remove licences on its own, but resetting the user's password and deleting the mailbox wait. The service-desk lead gets an email showing the action and its inputs, approves it, and the run continues.

Common pitfalls

• Approval fatigue. Gating every read trains people to click yes without looking.
• Self-approval. An approval the agent's own credential can grant is not an approval. OWASP warns that a simple "user confirmed" flag is not enough.
• Approvals in chat only. A "yes" typed in a chat window leaves no durable record and is easy to forge in the conversation.
• Not bound to arguments. Approving "send an invoice" must not also approve a different amount.

How actionlake handles it

Each actionlake key has a confirm_policy: agent, human_for_writes or human. Destructive actions always need an explicit confirm: true, and under human the agent's key cannot confirm itself. Key approval rules gate chosen actions and name who approves. When one applies, the run suspends until that person decides, in the console or from a signed link in an approval email, then resumes. Plans can include an approval step with a named approver. Deciding through the API needs the literal approve:* grant; * does not include it, so an agent key that may run everything still cannot approve its own action. The decision, who made it and when are kept; the free-text comment and addresses are cleared after 90 days. See agent permissions and the trust page.