Human approval gates: a practical pattern for trustworthy AI agents

AI agents are most valuable when they can take actions, not just produce text. They are also most dangerous at exactly that point. An agent that drafts an email is a productivity tool. An agent that sends emails to customers without anyone looking is a liability.

The pattern we use to resolve this tension is simple to state: agents may act freely inside the system, but every action that leaves the system requires a human approval that the code cannot bypass.

Separate internal actions from external ones

Start by classifying every tool an agent can call:

• Internal, reversible actions — reading data, researching, summarising, updating a draft, adding a note to an internal record. These can run autonomously, because a mistake is cheap to undo.
• External or irreversible actions — sending a message, publishing content, making a payment, changing a customer-facing system. These are proposals until a person approves them.

The classification belongs in the domain model, not in a prompt. A prompt that says “always ask before sending” is a suggestion to a probabilistic system. A domain rule that refuses to execute an unapproved external action is a guarantee.

Make the gate evidence-based

An approval button alone tends to become a rubber stamp. Reviewers approve faster when they are tired, and agents produce a lot of proposals. A better gate asks two questions:

1. Is the proposal ready? Before a human sees it, automated checks confirm that the required evidence exists — the sources the agent relied on, the record it is acting on, and any policy checks (for example, that the recipient has not opted out).
2. Does a person agree? Only proposals that pass the readiness check reach the review queue, with the evidence displayed alongside the action.

This keeps the reviewer’s attention on judgement instead of on detective work.

Encode the policy as pure rules

The readiness policy should be a pure function: given a proposed action and its evidence, return ready or not ready with reasons. Pure rules are easy to unit-test exhaustively, easy to review, and impossible to talk around. They also make the system auditable — you can show exactly why any action was or was not allowed.

propose(action) → readiness(action, evidence) → [human approval] → execute(action)
                         ↓ not ready
                   back to the agent with reasons

Keep a complete audit trail

Every proposal, check result, approval, rejection and execution should be recorded with who or what performed it and when. When something goes wrong — and in production, something eventually does — the audit trail turns an argument into a lookup.

Meter the model, not just the agent

Agents can loop. Route every model call through a single gateway that records usage and enforces budgets per agent and per task. A runaway loop then becomes a budget alert rather than an invoice surprise.

What this buys you

Teams sometimes worry that approval gates make agents less useful. In practice the opposite tends to happen. Because the dangerous edge is guarded by construction, you can give agents more internal autonomy: more tools, more data and longer-running tasks. The agent does the research and preparation, which is most of the work, and a person makes the decisions that carry consequences.

That is a division of labour that holds up in front of customers, auditors and your own engineers.