This article is part of our AI Agent Guides. See how models compare this week on the AI Agent Leaderboard, a ranking of rankings refreshed every week.
Require human approval for any agent action that is hard to undo, moves money, reaches outside your company or affects someone's rights. Let an agent act alone only on actions that are low-risk and easy to reverse, and sample those regularly.
The decision table below is our editorial framework, not a legal standard. Benchmarks do not tell you where to draw this line, though the reliability board can help you judge how much to trust a model. It changes weekly, so check it when you review your rules.
Disclosure: eSEOspace is a member of the Claude Partner Network.
At a glance
"Human in the loop" means a person checks or approves an agent's work before it takes effect. There are levels to this, so you do not need a person on every step.
| Level | How it works | Good for |
|---|---|---|
| Autonomous | The agent acts, and logs it | Low-risk, reversible actions |
| Sampled review | The agent acts, and a person audits a sample | High-volume, low-harm actions |
| Approve before action | The agent pauses until someone says yes | High-impact actions |
| Draft only | The agent prepares, and a person does it | Regulated or sensitive work |
| Prohibited | The agent cannot do this at all | Actions you never want automated |
The decision table
Use this table as a starting point. Move an action up a level if your industry or contract demands it.
| Action | Reversible? | Suggested control | Why |
|---|---|---|---|
| Read internal docs | Yes | Autonomous, if access is scoped | Low impact, but limit the scope |
| Search the public web | Yes | Autonomous, treat results as untrusted | Content may carry hidden instructions |
| Draft an email or report | Yes | Autonomous drafting | Nothing has left the building |
| Label or route a support ticket | Yes | Sampled review | Errors are easy to fix |
| Edit code on a branch | Yes | Autonomous, review before merge | The merge is the true gate |
| Update a CRM field | Mostly | Sampled review | Changes can spread quietly |
| Merge to production | Partly | Approve before action | Can break live systems |
| Send a customer email | No | Approve first, relax for tested templates | You cannot unsend it |
| Publish web content | Partly | Approve before action | Public and quickly copied |
| Issue a refund or payment | Often no | Approve before action, add limits | Direct financial loss |
| Delete records | Often no | Approve before action | Check backups first |
| Change permissions or keys | Partly | Approve before action | Widens every later risk |
| Hiring, lending, or benefit decisions | No | Draft only, human decides | Affects people's rights |
| Legal, medical or tax advice | No | Draft only, professional review | Requires a qualified person |
Five questions to classify any action
- Can you undo it? If undoing it takes more than a few minutes, or is impossible, add approval.
- What is the worst realistic cost? Set a dollar threshold. Below it, sample. Above it, approve.
- Does it leave your company? Anything a customer, regulator or the public sees deserves more care.
- Does it affect a person's rights or money? If so, a person should make the call.
- Can the agent be tricked into it? If it reads untrusted content, raise the level.
The last question matters more than it looks. Prompt injection, where hidden text gives the agent instructions, can trigger actions you would never request. See our security risks guide.
What the standards say
Security guidance agrees on this approach. OWASP's excessive agency entry says to require a human to approve high-impact actions before they are taken. Its prompt injection entry lists human approval for high-risk actions as a mitigation.
The Model Context Protocol specification says hosts must obtain explicit user consent before invoking any tool. MCP is an open standard for connecting agents to tools. Many apps then let you pre-approve certain tools, so check what yours allows.
Rules may apply as well. Article 14 of the EU AI Act requires high-risk AI systems to be designed so people can effectively oversee them. It covers awareness of automation bias, and the ability to intervene or decide not to use the system.
Not every agent is high-risk under that law. Ask a qualified attorney whether it applies to you, because this article is not legal advice. In the US, your industry's rules may set their own requirements.
Approval only works if people pay attention
An approval step can become a rubber stamp. If people click yes 200 times a day, the 201st will not get a real look.
The EU text names this tendency as automation bias, meaning over-relying on what a system produces. Anthropic's docs call the same issue prompt fatigue. They offer an auto mode where a classifier reviews actions in place of a person.
To keep approval meaningful:
- Approve fewer, more important actions, rather than everything.
- Show the reason, the exact change and the risk in one view.
- Set a limit on how many approvals one person handles per hour.
- Plant test cases now and then, and track whether reviewers catch them.
- Require a second person for the highest-value actions.
- Review rejected actions each month, and fix the cause rather than the symptom.
How to build approval in
Do not rely on instructions like "always ask first". A model can ignore or be talked out of them. Enforce approval in code and in the systems the agent calls.
Most tools now support this, and these are the options from the docs we read on 2 November 2026:
| Tool | Approval feature |
|---|---|
| OpenAI Agents SDK | Tools declare a need for approval, and the run pauses until someone approves or rejects |
| LangGraph | Interrupts pause the graph, save state and resume with human input |
| Claude Code | Permission modes, from manual to auto, plus allowlists for automated runs |
| Codex | Approval policy; destructive tool calls need approval when the tool declares it |
| OpenAI Agent Builder | Human approval node, with advice to keep tool approvals on |
Note the Codex wording. Approval depends on the tool declaring itself destructive, so a poorly labeled tool can slip through. Our take: review your tools' labels rather than trust them.
Back this up downstream. OWASP advises implementing authorization in downstream systems. For example, set a refund cap in your payment system, so the agent cannot exceed it even if every other check fails.
Handing off well
A good approval request is short and specific. It should answer these questions:
- What will happen, in one sentence?
- Which record, customer or file is affected?
- Why does the agent think this is right?
- What source did it rely on?
- What happens if you say no?
Also decide what happens if nobody responds. The safe default is that nothing happens, and the request expires. Never let an agent treat silence as approval.
When to loosen the rules
Autonomy should be earned with data. Start with approval on, and measure how often reviewers change or reject each action type.
As a rule of thumb, consider moving an action type to sampled review only when all of these hold:
- Reviewers almost never change it over a long enough sample.
- The action is reversible or capped.
- You have logs and a fast way to stop the agent.
- A recent model or prompt change has not reset your evidence.
Rerun your tests after each change, using our agent scorecard. A new model may do better on average and still fail differently. Compare models on the leaderboard, and read the methodology to see what it does not measure.
Which should you choose
Choose approve before action for your first agent, on anything that writes. You will learn the failure patterns quickly, and customers will not pay for that lesson.
Choose sampled review once you have data for reversible, high-volume actions. Pick a sample rate you can sustain.
Choose draft only for legal, medical, tax, financial, hiring and similar decisions. A qualified professional should review the output, and that person stays accountable for the result.
If you need help mapping permissions for connected tools, try the MCP tool permission planner.
Frequently asked questions
Does human in the loop defeat the purpose of an agent?
No. The agent still does the research, drafting and checking, and the person only makes the final call. A short review of a prepared action is far faster than doing all the work by hand.
What is the difference between in the loop and on the loop?
In the loop usually means a person approves before an action. On the loop usually means a person monitors and can step in afterward. These are common terms rather than strict legal definitions, so define them in your own policy.
How much should I sample?
There is no universal number. Start high, such as a large share of actions in week one, then reduce it as your error data improves. Keep sampling even when results look good, because models and data change.
Who is responsible if an approved action goes wrong?
Usually your organization, though the details depend on your contracts and the law. Keep records of who approved what, and ask your attorney about your specific duties.
