Guide · agent governance
Human-in-the-loop approvals for AI agents
Autonomy is not a switch, it's a gradient. The interesting engineering is in the middle: agents that do the work and stop at exactly the right moments — with a decision a human can actually review.
When should an agent stop and ask?
The useful rule: gate by consequence, not by confidence. A model's self-reported certainty is not a safety property; the blast radius of the action is. A practical policy ladder:
Two properties matter more than the exact rows. The ladder is enforced outside the model — a prompt can be talked out of its rules; a policy engine cannot. And it is readable by the human — you should be able to open a settings screen and see exactly what your agents may do without you.
Anatomy of a reviewable approval
Most approval UX fails by being either a scary wall of transcript or a naked "Allow?" button. A reviewable approval answers six questions on one screen: the exact action in plain words, the exact target (which repo, which environment, which account), the impact if it goes well, the risk tier, the evidence (diff, test run, staging log, metric trend — each checksummed), and an expiry.
The expiry is underrated. Evidence goes stale: a diff verified against yesterday's staging is not verified against today's. An approval that expires forces the agent to re-verify rather than letting a Friday request execute on Monday.
Make the yes deliberate
A click is too cheap for a production deploy. VIVUU's terminal uses press-and-hold to approve — a second of deliberate contact, the same gesture its future hardware gives a physical key — and requires a written reason to deny. Both land in an append-only audit trail alongside what the agent then did and whether verification passed.
Dual approval: when one yes is not enough
For money movement and security-adjacent changes, one human is a single point of failure — of attention, not just of ethics. Dual approval means your sign-off moves the task to a waiting-on-co-signer state instead of executing; a second approver (finance, a co-founder, an on-call peer) must co-sign before anything runs. The audit trail then shows three attributable acts: you approved, they co-signed, the agent executed and verified.
FAQ
- What happens when an agent triggers a human-in-the-loop approval?
- The task pauses in a WAITING_APPROVAL state and a decision request is created: the exact action, the exact target, the expected impact, the risk tier, the supporting evidence, and an expiry. A human approves or denies (with a written reason). On approval the agent executes, verifies the result, and both the decision and the outcome are written to an audit trail. If the approval expires, nothing runs — the agent must refresh its evidence and ask again.
- Which agent actions should require human approval?
- Tier by consequence, not by frequency. Reads and drafts can be auto-allowed. Reversible internal changes can run with constraints (branch-scoped, auto-revertable). Anything external or hard to undo — production deploys, outbound messages, spending — should require approval. Moving money or changing security controls warrants dual approval or an outright deny. The tiers should live in policy, enforced by the platform, not in the model's prompt.
- What tools support human-in-the-loop approvals today?
- Framework-level: LangGraph interrupts and LangChain's agent-inbox pattern pause a graph until a human responds; n8n has approval nodes for workflows; MCP elicitation lets a tool ask the user mid-call. These give you the pause. What they leave to you is the decision surface — evidence, risk framing, expiry, audit — which is the part that makes approvals reviewable rather than a reflexive yes.
- Why require a reason when denying an agent's request?
- A denial without a reason teaches nothing and audits badly. The written reason feeds the audit trail (why was this stopped?), tunes future behavior (the agent or its operator learns which line was crossed), and keeps the human honest — a one-word veto invites rubber-stamping in the other direction too.
see the whole flow, live
Everything on this page — the queue, the evidence, the hold-to-approve, the audit trail — is working in the VIVUU terminal as an interactive preview on realistic mock data. No sign-up.