Putting a human in the loop is the standard answer to agent risk. It works until volume grows and the loop becomes a queue: approvers click through requests without reading them, delays pile up, and the safety measure turns into a ritual. A gate that is always approved isn't a control. It's latency.
Gate by consequence, not by default
- Auto-run — low-consequence, reversible actions with strong history: drafts, internal notes, read-only lookups. Log them; don't interrupt anyone.
- Review after — moderate-consequence actions the agent performs, with a sample reviewed periodically. Problems are caught in aggregate, and the sampling rate rises if error signals appear.
- Approve before — high-consequence or irreversible actions such as payments, outbound commitments, record deletion. A person decides before anything happens.
- Never — actions the system is not permitted to take at all, enforced in the tool layer rather than the prompt.
Make approval fast and meaningful
- Show the decision, not the transcript — the proposed action, the evidence it rests on, and the one thing the approver should check. A page of reasoning invites rubber-stamping.
- State the confidence and the reason it's uncertain — so attention goes to the cases that need it.
- Allow edit, not just yes or no — a corrected approval is also training data for the next version.
- Measure the override rate — if approvers change nothing for weeks, that action can move to a lighter gate. If they change a lot, the agent needs work.
Review how long requests wait, not only how many are approved. An approval that arrives after the customer has left has the same effect as a rejection.
Plan for absence
Define who approves when the primary approver is away, what happens when nobody responds in time, and which actions simply expire. A system whose gate depends on one person's inbox has a single point of failure with a human face. Design the loop so that it keeps humans accountable without making them the slowest part of the system.