--- title: "Human-in-the-loop approval for AI agents - actionlake" description: "Human-in-the-loop approval pauses an AI agent's action until a named person approves or rejects it. When to require it, how it works, and how it is bypassed." canonical: https://actionlake.com/glossary/human-in-the-loop-approval updated: 2026-10-22 --- Control and proof # Human-in-the-loop approval Human-in-the-loop approval is a control that pauses an AI agent's action until a named person approves or rejects it, so high-impact or irreversible actions never run on the model's judgement alone. Updated 22 October 2026 Also called HITL approval, Human approval for AI agents, Agent approvals 4 sources checked **On this page** Connect an agent to every system you run. 100,000 calls free a month. No card. [Start free](https://actionlake.com/console?start=sandbox) ## What it is Some actions should never run on a model's say-so: paying a supplier, deleting a user, emailing every customer. Human-in-the-loop approval puts a person between the agent's decision and the action. The MCP tools specification says that for trust and safety there should always be a human in the loop with the ability to deny tool invocations. The OWASP Top 10 for LLM applications recommends human approval for high-impact actions as a mitigation for excessive agency. ## Why it matters Approvals contain the damage from both mistakes and manipulation. A prompt-injected agent that tries to export a customer list stops at the approval. Regulation points the same way: Article 14 of the EU AI Act requires high-risk AI systems to be designed so that people can oversee them, override their output and interrupt them. ## How it works 1. **Decide what needs approval.** Usually writes with financial, security or irreversible effect, not every read. 2. **Bind the approval to the exact action.** OWASP's agent cheat sheet says approval must be tied to the specific action and arguments, and decision kept separate from execution. 3. **Suspend the run** and tell a named approver what is waiting. 4. **Record the decision**, who made it and when. 5. **Resume or stop** the run exactly where it paused. ## Example An IT agent processing a leaver can disable the account and remove licences on its own, but resetting the user's password and deleting the mailbox wait. The service-desk lead gets an email showing the action and its inputs, approves it, and the run continues. ## Common pitfalls - **Approval fatigue.** Gating every read trains people to click yes without looking. - **Self-approval.** An approval the agent's own credential can grant is not an approval. OWASP warns that a simple "user confirmed" flag is not enough. - **Approvals in chat only.** A "yes" typed in a chat window leaves no durable record and is easy to forge in the conversation. - **Not bound to arguments.** Approving "send an invoice" must not also approve a different amount. ## How actionlake handles it Each actionlake key has a `confirm_policy`: `agent`, `human_for_writes` or `human`. Destructive actions always need an explicit `confirm: true`, and under `human` the agent's key cannot confirm itself. Key **approval rules** gate chosen actions and name who approves. When one applies, the run suspends until that person decides, in the console or from a signed link in an approval email, then resumes. Plans can include an approval step with a named approver. Deciding through the API needs the literal `approve:*` grant; `*` does not include it, so an agent key that may run everything still cannot approve its own action. The decision, who made it and when are kept; the free-text comment and addresses are cleared after 90 days. See [agent permissions](https://actionlake.com/glossary/ai-agent-permissions) and the [trust page](https://actionlake.com/trust). ## Questions **Which AI agent actions should require human approval?** Actions that move money, change access, delete data or contact customers at scale. Reads and low-risk writes usually should not, or approvals become a rubber stamp. **Can another AI agent approve an action?** It can, but that is agent-to-agent confirmation, not human oversight. For high-impact actions, require a named person whose decision is recorded. **What happens to the agent while it waits for approval?** The run is suspended at that step. When the person approves, it resumes from the same point; when they reject, it stops and the rejection is recorded. ## Related terms - [AI agent permissions AI agent permissions are the rules that decide which systems, actions and data an agent's credential may reach, and least privilege for agents means granting only the actions a task needs and enforcing that limit outside the model.](https://actionlake.com/glossary/ai-agent-permissions) - [Agent plan An agent plan is a saved, versioned procedure of actions, cross-system joins, loops, waits and approval steps that an AI agent writes once and that then runs the same way on demand or on a schedule, without the model re-deciding every step.](https://actionlake.com/glossary/agent-plan) - [AI agent audit log An AI agent audit log is a record of every action an agent took: which credential ran it, what it did, in which system, with what outcome and cost, and why, kept so a person can reconstruct and verify events later.](https://actionlake.com/glossary/agent-audit-log) - [Prompt injection Prompt injection is an attack in which text that a language model reads, typed by a user or hidden in a web page, email, document or tool result, changes the model's behaviour, and in a tool-using agent it can turn into real actions.](https://actionlake.com/glossary/prompt-injection) - [AI agent An AI agent is software in which a language model decides its own next steps and tool calls in a loop, using results from its environment, until a goal is met or a stopping condition is reached.](https://actionlake.com/glossary/ai-agent) ## Sources 1. [Server features: Tools (2025-11-25)](https://modelcontextprotocol.io/specification/2025-11-25/server/tools) Model Context Protocol · checked 22 October 2026 2. [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) OWASP Gen AI Security Project · checked 22 October 2026 3. [AI Agent Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html) OWASP Cheat Sheet Series · checked 22 October 2026 4. [EU AI Act, Article 14: Human Oversight](https://artificialintelligenceact.eu/article/14/) artificialintelligenceact.eu · checked 22 October 2026 [All 30 glossary terms](https://actionlake.com/glossary) ## Connect an agent. Start free. [Start free](https://actionlake.com/console?start=sandbox) [Read the quickstart](https://actionlake.com/docs/quickstart) 100,000 calls free every month. No card. Hard caps on every key. --- Source: https://actionlake.com/glossary/human-in-the-loop-approval More: https://actionlake.com/llms.txt