Human-in-the-Loop AI Agents: Approval Patterns, Logging and Autonomy Levels
Usama · November 7, 2026
A human-in-the-loop AI agent is one where a person sits at defined points in the process to review, approve, correct or stop what the agent is about to do. The practical question is not "should a human be involved?" but "for which actions, and how much?" Set the level per action: let the agent act freely on reversible, internal steps, ask for approval on anything customers or money will see, and keep a kill switch within reach for everything.
Why do approval gates matter?
An agent chooses its own steps, so you cannot list in advance everything it will do. What you can list is what it is able to do. The OWASP project calls the danger "excessive agency" and traces it to three causes: tools that do more than needed, permissions broader than needed, and high-impact actions taken without independent checking. Among its mitigations are requiring human approval for high-impact actions such as sending messages or deleting data, and enforcing authorisation in the target system instead of trusting the model.
The Model Context Protocol specification says the same thing in its own terms: for trust and safety there should always be a human in the loop with the ability to deny tool invocations, and clients should prompt for confirmation on sensitive operations. Anthropic's engineering guide lists human checkpoints and stopping conditions, such as a maximum number of iterations, among the standard controls for agents. Approvals are a normal part of agent design, not a sign the technology is failing.
Which approval patterns exist?
Five patterns cover most real designs. They stack: a single agent often uses several for different actions.
1. Draft-only
The agent prepares everything and sends nothing. A reply sits in a draft folder, a quote is saved as a PDF, a record update is staged as a proposed change. A person does the final act. This is where almost every project should start, because it makes the agent's judgement visible with no outside consequences. The cost is that a person still touches every item.
2. Approve-to-send
The agent proposes a specific action and waits. The reviewer sees the exact message, amount or change, plus the evidence the agent used, and presses approve, edit or reject. It differs from draft-only in that the action is wired up and one click away, so the delay is short. The quality of the approval screen decides everything: show the facts that matter, the source records and the reason, not a wall of text.
3. Threshold gates
The agent acts alone below a limit and asks above it. Limits can be money (refunds under a fixed amount), volume (no more than a set number of emails per hour), scope (only customers in one segment) or confidence (the agent, or a separate checker, rates its own certainty and escalates when low). Thresholds should be set by the business, in numbers, and stored in configuration where they can be changed and audited, not left to the model's discretion. Treat model self-rated confidence as a weak signal and combine it with hard rules.
4. Sampling and audit
For high-volume, low-risk work, you cannot review everything, so you review a slice. The agent acts, and a random sample (plus every case that tripped a warning) is checked afterwards by a person. Raise the sample rate when anything changes, such as a new model, new prompts, new data sources or a rise in complaints. Sampling only suits reversible actions, because the check happens after the fact.
5. Kill switch
A single control that stops the agent immediately, owned by a named person who is not the builder: revoke its credentials, pause its queue, or turn off the trigger. Test it, since an untested kill switch is a hope. Pair it with automatic breakers such as a cap on steps per task, a cap on spend per day, and an automatic pause if error rates spike.
How do you decide the autonomy level for each action?
Do it action by action, not agent by agent. One agent can have a free hand reading a knowledge base and none at all issuing refunds. Ask these questions of every tool the agent can call:
- Can it be undone? A draft can be deleted; a sent email cannot be recalled.
- Who sees it? Internal-only effects are lower risk than anything customers, suppliers or regulators will see.
- What is the maximum damage? Think in money, data exposed and customers affected, for a single call and for a loop gone wrong.
- Does it involve personal or regulated data? If so, confirm the rules that apply with a qualified adviser; this article is general information, not legal advice.
- How good is the evidence? Autonomy should rise only with logged results from realistic tests. Our overview of testing and evaluating AI agents covers how to gather them.
The structure maps onto the ladder we describe in what agentic AI is for business, from assistant to narrow autonomy.
Action types vs recommended autonomy
This table is a starting position for a new agent, not a rule. Illustrative thresholds should be replaced with your own numbers, and anything regulated needs professional advice.
| Action type | Example | Reversible? | Recommended starting autonomy |
|---|---|---|---|
| Read internal data | Look up an order, search the knowledge base | Yes | Autonomous, read-only credentials, logged |
| Classify or tag | Label an enquiry, set a priority | Yes | Autonomous; sample-audit weekly |
| Write internal notes | Add a summary to a CRM record | Mostly | Autonomous with an edit history |
| Draft customer message | Reply to a support ticket | Yes until sent | Draft-only; approve-to-send |
| Send routine message | Order confirmation from a fixed template | No | Autonomous only for fixed templates; otherwise approve-to-send |
| Update customer or order data | Change an address, set order status | Partly | Approve-to-send; thresholds once tested |
| Financial action | Refund, credit note, payment | Hard | Threshold gate with human approval above a low limit; none above a higher one |
| Delete or merge records | Remove duplicates, purge accounts | Hard | Human approval every time, or do not expose the tool |
| Public publishing | Social post, review reply, web page change | No | Approve-to-send, always |
| Legal, medical or financial advice | Anything a professional is accountable for | No | Human decides; agent only gathers material |
| Change its own permissions or tools | Grant itself access, install a plugin | No | Never autonomous |
Claude Code, Anthropic's coding agent, shows the same graded idea in a product. Its permission modes run from asking before edits and commands, through auto-approving edits, to a bypass mode that Anthropic says should only be used in isolated environments. Autonomy is a dial per context, not a yes or no.
What should you log?
Logs are what turn an approval gate into evidence. The MCP specification suggests logging tool usage for audit purposes, and you will need the same record to investigate a mistake, answer a customer or decide whether to loosen a limit. For every agent run, capture:
| Record | Why it matters |
|---|---|
| Trigger and goal (what started the run, original request) | Reconstruct the context |
| Each tool call with inputs, outputs and timestamps | See exactly what it did and what it saw |
| Model and prompt version | Explain behaviour changes after an update |
| What was proposed, shown to the reviewer, and what was sent | Prove who approved what, and spot edits |
| Approver identity, decision, time and any edit or reason for rejection | Accountability and a source of training examples |
| Cost, step count and errors | Catch loops, runaway spend and rising failure rates |
| Which limit or breaker triggered, if any | Tune thresholds with real data |
Be careful what the logs themselves contain. They may hold personal data, so apply the same access control and retention rules as the source systems; see our note on AI and data privacy. Review rejections regularly: a pattern of edits is the most useful feedback you will get for improving the agent.
How do you stop approvals becoming a rubber stamp?
The common failure is not missing approvals but approvals nobody reads. When reviewers see dozens of near-identical requests, they click through. A few countermeasures:
- Ask for approval only where it changes the outcome. Let the agent handle low-risk steps so reviewers see fewer, higher-stakes items.
- Show the diff: what will change, compared with now, with the source evidence one click away.
- Put the riskiest items first and mark them clearly.
- Seed occasional known-bad test items to check reviewers are still catching problems.
- Track approve-without-edit rates by reviewer and by action; a rate near 100 percent on a risky action means either the agent is excellent or nobody is looking, and the logs should tell you which.
How should you roll out autonomy over time?
- Weeks one and two: draft-only for everything outward-facing; read-only tools.
- Next: approve-to-send for the actions you want to speed up; record accept, edit and reject rates.
- Then: introduce thresholds for the lowest-risk, best-performing action; keep sampling it.
- Ongoing: re-test whenever the model, prompts, tools or data change, and be ready to step an action back down.
If your workflow runs in n8n, n8n-based automation makes approval steps easy to add: n8n's documentation describes a human review step for AI Agent tools, where the workflow pauses until a person approves or denies the tool call, with requests sent through channels such as Slack, Telegram, Microsoft Teams, Gmail or WhatsApp. We design these checkpoints into every agentic AI build, and our guide to prompt injection explains why tool permissions and approvals are your last line of defence when an agent reads untrusted text.
Last verified November 2026 against OWASP, the MCP specification and Anthropic's documentation. Thresholds in this article are illustrations, not recommendations for your business.
Deciding what your agent may do alone?
Send us the list of actions and what each can cost if it goes wrong, and we will map an approval design to it.
Map your approvals →Frequently asked questions
What does human in the loop mean for an AI agent?
It means a person reviews, approves or can stop the agent at defined points. The agent may do the preparation, but a human confirms the actions that matter, such as sending a message to a customer or approving a refund.
What is the difference between human in the loop and human on the loop?
In the loop, a person approves each action before it happens. On the loop, the agent acts and a person monitors, auditing samples and able to intervene or shut it down. The first suits risky actions; the second suits high-volume, reversible ones.
Will approvals make the agent too slow to be useful?
Not if you gate selectively. Approvals on a handful of consequential actions cost seconds, while the research, lookups and drafting still happen automatically. Gating everything is what makes agents feel slow.
When can an agent act without approval?
When the action is reversible, internal, low in cost and backed by logged test results, such as tagging a ticket or writing an internal note. Even then, keep logs, sample-check results and keep a kill switch.
Do I need an approval workflow if the agent only drafts text?
Yes, a light one. Somebody still decides whether a draft is sent, and drafts can contain wrong facts. Make sure the reviewer sees the source facts alongside the draft.
Related Services