Human Approval Gates for AI Agents

Put The Gate Before The Tool Call

The approval gate belongs before the side effect. If the agent has already sent the email, deleted the row, issued the refund, changed the CRM field, or exposed a private record, the human is no longer approving. They are cleaning up.

A production agent needs an action taxonomy before it needs another prompt. Treat the agent's possible tool calls as these classes:

Galileo's April 27, 2026 production HITL guide frames the same boundary around context, not model confidence alone: financial thresholds, reputational risk, task complexity, and multi-agent chain complexity can each trigger escalation. That is the right instinct. Confidence is a signal. Risk is the policy.

For a support agent, this means the model can draft a refund response and gather order history, but the refund tool pauses when the amount crosses policy, the customer is flagged, or the account has conflicting ownership. For an internal ops agent, read-only analysis can proceed, but entitlement changes, production config edits, and destructive data actions stop before the tool call.

The test is simple: if a failed action creates customer impact, data exposure, money movement, or operational cleanup, approval happens before execution. If the mistake can be corrected cheaply and safely, log it for audit and review the pattern later.

The Gate Contract Is The Product Boundary

A gate is a contract between the agent loop, the reviewer, and the audit trail. The reviewer should never approve a vague request such as "continue?" They should approve a specific proposed action with enough context to make the decision defensible later.

The approval request should carry this payload:

This is where many agent demos fail. They route a message to Slack and call it HITL. That works for a demo because the human remembers the context. It breaks in production because the reviewer cannot see the exact state, the agent cannot resume deterministically, and the audit trail cannot explain why the action happened.

For a real system, the approval UI is only the surface. The product boundary is the data contract. If the reviewer edits a draft, the resume payload should contain the edited draft. If they reject a tool call, the agent should receive a rejection reason and move to a safe fallback. If they escalate, the agent should stop waiting on the first reviewer and move the same state bundle to the next queue.

The same idea applies to context engineering. The agent needs a stable context contract that says what state exists, what policy applies, and what evidence can be shown. That is why context engineering for production agents matters more than a longer system prompt.

Persist State Before You Ask A Human

Pause and resume must be a runtime feature, not a conversation convention. The agent should persist the exact state before asking for approval, then resume from that state with the human decision as input.

LangGraph's interrupt documentation gives a concrete pattern. Its interrupts pause graph execution at specific points, save graph state using the persistence layer, surface a JSON-serializable value to the caller, and resume by re-invoking the graph with Command. LangGraph also uses thread_id as the pointer for which checkpointed state to load.

from typing import TypedDict

from langgraph.types import Command, interrupt


class AgentState(TypedDict):
    run_id: str
    proposed_tool: dict
    policy_trigger: str
    source_context: dict
    approval: dict | None


def approval_gate(state: AgentState):
    request = {
        "run_id": state["run_id"],
        "proposed_tool": state["proposed_tool"],
        "policy_trigger": state["policy_trigger"],
        "source_context": state["source_context"],
        "review_options": ["approve", "reject", "edit", "escalate"],
    }

    decision = interrupt(request)

    if decision["status"] != "approve":
        return {
            "approval": decision,
            "proposed_tool": None,
        }

    return {"approval": decision}


def resume_after_review(graph, run_id: str, reviewer_id: str, reason: str):
    return graph.invoke(
        Command(
            resume={
                "status": "approve",
                "reviewer_id": reviewer_id,
                "decision_reason": reason,
            }
        ),
        config={"configurable": {"thread_id": run_id}},
    )

The important part is not the framework. It is the invariant:

• The paused state is persisted before the reviewer is notified.
• The approval request is JSON-serializable so it can be stored, displayed, and replayed.
• The resume command is a decision object, not a freeform chat message.
• The same state pointer resumes the same run.
• The executed action is logged after the reviewed decision.

That is the practical split between a production agent and a chat workflow with buttons. If your agent cannot persist the state and resume from the same checkpoint, it cannot safely wait for a human. A durable graph runtime is one way to do it; the architecture rule is the same in a custom queue, Temporal workflow, or job runner.

The related framework choice is covered in LangChain vs LangGraph for production agents, but the approval rule is simpler: choose any runtime that can pause, persist, resume, and audit without depending on memory in a chat transcript.

Design The Reviewer Queue Against Rubber-Stamping

The human gate is not automatically a safety guarantee. Under load, reviewers can start approving faster than they inspect. The gate needs queue design, sampling, and accountability, or it becomes a slower version of auto-approval.

A June 21, 2026 arXiv paper on AI agent code review studied 400 repeat reviewers and 11,429 reviews across a seven-month observation period. It observed approval rate moving from 30.1% to 36.8%, a cumulative +14.5 percentage point gap from first to tenth experience decile, review latency increasing by +3.5x, and inline comment volume decreasing by 22%. The paper's domain is code review, not every agent workflow, but the operating lesson transfers: repeated gates can create habituation if the queue is not designed for scrutiny.

Build the reviewer queue like a production system:

• Show the diff or proposed side effect first, not the model's fluent explanation.
• Require a short rationale for approvals on sensitive actions.
• Separate edit from approve so reviewers can correct without rubber-stamping.
• Sample approved actions for peer review when the policy trigger is high-risk.
• Track reject reasons and feed them back into policy, prompts, and evals.
• Keep escalation paths explicit so hard decisions do not sit in one person's queue.

The review screen should bias toward inspection. For a customer-facing agent, put the customer record, policy trigger, source evidence, and proposed outbound message above the approve button. For an internal infrastructure agent, show the exact command, target environment, ownership, rollback path, and current incident context.

The approval log should also be useful during an incident. If an agent executed a sensitive action, an operator should be able to answer: who approved it, what state did they see, what policy fired, what changed after resume, and what happened next. If any one of those fields is missing, the gate is not audit-ready.

Treat Approval As One Sensor, Not The Enforcement Boundary

Human review degrades when a queue mostly presents benign actions. Anthropic's February 2026 Risk Report makes that failure mode concrete inside its own Claude Code deployment. The report says commands outside a user's allowed prefixes are usually shown for review, but that review appears weak even against simple attempts to make a command look relevant. It also says a majority of users auto-approve code changes and simple execution commands, which removes the blocking review for those actions. (Anthropic Risk Report, section 7.4.8)

The right response is not a more alarming approval dialog. Make the reviewer one layer in a control stack:

• Bind the exact proposal and policy trigger before review so the approved object cannot change underneath the decision.
• Enforce high-risk invariants outside the model and reviewer UI. Branch protection, credential scope, egress policy, transaction ceilings, and target allowlists should reject prohibited actions even after an approval mistake.
• Keep edit, reject, and escalate first-class. A binary approve button trains the queue toward completion rather than scrutiny.
• Sample approved actions and compare the reviewed proposal with the executed outcome. The audit trail should detect both reviewer error and post-approval mutation.
• Test the entire pipeline. A strong monitor score on selected trajectories does not qualify the filter, alert routing, human investigation, or response path.

Anthropic describes the same layered direction: manual and model code review, invariant tests, security monitoring, sampled trajectory supervision, and human investigation. It also states the limitations directly: incomplete coverage, no external sabotage-oriented monitoring beyond voluntary reports, and no end-to-end evaluation of the automatic monitors (printed pages 33 to 34 and 95 to 98). The operating rule is stricter than "keep a human in the loop": keep the dangerous action inside external invariants even when the human loop is tired.

Roll Out Gates In A Production Agent

The rollout starts with policy and state, not UI. A good approval button on top of a weak state model still produces weak control.

Here is the smallest policy shape that holds up:

type GateDecision =
  | { kind: "allow" }
  | { kind: "pause"; policyTrigger: string; reviewerGroup: string }
  | { kind: "escalate"; policyTrigger: string; reviewerGroup: string }
  | { kind: "deny"; policyTrigger: string };

type ProposedAction = {
  toolName: string;
  effect: "read" | "write" | "external_message" | "sensitive" | "destructive";
  reversible: boolean;
  policyTags: string[];
};

export function gatePolicy(action: ProposedAction): GateDecision {
  if (action.effect === "destructive") {
    return {
      kind: "escalate",
      policyTrigger: "destructive action requires senior review",
      reviewerGroup: "operations",
    };
  }

  if (!action.reversible || action.effect === "external_message") {
    return {
      kind: "pause",
      policyTrigger: "external or irreversible side effect",
      reviewerGroup: "owner",
    };
  }

  if (action.policyTags.includes("private-data")) {
    return {
      kind: "pause",
      policyTrigger: "private data exposure risk",
      reviewerGroup: "data-owner",
    };
  }

  return { kind: "allow" };
}

This policy is intentionally boring. It does not ask the model whether approval is needed. The model proposes an action; the policy decides whether the action pauses. That separation is what makes the system debuggable.

For a custom agent, start by protecting the action that can hurt the business fastest. In customer support, that is usually refunds, account changes, sensitive data exposure, and external messages. In sales ops, it is CRM writes, outbound messages, discount exceptions, and account ownership changes. In internal engineering, it is production config, secrets, deploys, and destructive commands.

The Durable Takeaway

Human-in-the-loop is not a checkbox. It is a state machine with a reviewer UI attached.

The production version has a few non-negotiable properties: policy decides when to pause, persistence saves the exact run state, the reviewer approves a specific action with context, and the system resumes with a structured decision that becomes part of the audit trail. That is the difference between "a person saw a Slack message" and a controlled agent workflow.