--- id: CP-508 slug: human-in-the-loop-ai-agent-approval lang: en title: Human approval for AI agents description: An AI agent can prepare an action, but some must be approved by a person. What the employee reads, accepts or refuses. canonical_url: https://startbrain.io/cyberpedia/en/articles/human-in-the-loop-ai-agent-approval/ markdown_url: https://startbrain.io/cyberpedia/en/articles/human-in-the-loop-ai-agent-approval.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Human approval for AI agents", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/human-in-the-loop-ai-agent-approval/ (CC BY 4.0) wing: 4 theme: use_responsibly reflex: air-039 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/human-in-the-loop-ai-agent-approval/ fr: https://startbrain.io/cyberpedia/fr/articles/validation-humaine-agents-ia-actions-interdites/ de: https://startbrain.io/cyberpedia/de/articles/menschliche-freigabe-ki-agenten-verbotene-aktionen/ es: https://startbrain.io/cyberpedia/es/articles/validacion-humana-agentes-ia-acciones-prohibidas/ sources: - "n": 1 title: Intelligence artificielle | CNIL publisher: CNIL url: https://www.cnil.fr/fr/intelligence-artificielle accessed: "2026-11-03" - "n": 2 title: LLM01:2025 Prompt Injection publisher: OWASP url: https://genai.owasp.org/llmrisk/llm01-prompt-injection/ accessed: "2026-11-03" - "n": 3 title: LLM06:2025 Excessive Agency publisher: OWASP url: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/ accessed: "2026-11-03" - "n": 4 title: AI Risk Management Framework publisher: NIST url: https://www.nist.gov/itl/ai-risk-management-framework accessed: "2026-11-03" - "n": 5 title: Guidelines for secure AI system development publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development published: "2023-11-27" accessed: "2026-11-03" --- # Human approval for AI agents An AI agent no longer just answers a question. It can read a mailbox, open documents, call other tools and act in place of its user. The CNIL describes an agentic AI "now able to act on its environment in place of its user" [1]. The principle of human approval (in English, Human-in-the-Loop) answers this change: the agent prepares, and a person approves before the action takes place. This page explains what the employee must read before clicking, and when to refuse. ## In 30 seconds - Where it happens: an AI assistant or agent offers to send a message, delete a file, make a payment or change an access right. - What the attacker wants: to get the agent to carry out an action, for example by hiding instructions in an email or a web page that the agent reads [2]. - The reflex: never approve an agent's action without having read what it does, and refuse if information is missing. - If it is already done: tell Brain's security team right away, then stop using the agent concerned until they reply. ## Straight answers ### What is human approval? It is a step where a person must say yes before a high-impact action is carried out. OWASP describes it this way: use human control to require a person to approve high-impact actions before they are taken [3]. OWASP gives an example: an application that posts content to social media on behalf of a user must include an approval routine in the extension that performs the posting [3]. ### Which actions must always go through a person? This page keeps five categories: payments, data deletion, sending messages to the outside, changing access rights and decisions that affect people. The sources cited here do not draw up this list. They speak of "high-impact actions" [3] and give as examples deleting documents without user confirmation and sending messages [3]. ### Why can't the agent judge on its own? Because it can be wrong or be manipulated. OWASP calls "Excessive Agency" the weakness that allows damaging actions in response to unexpected, ambiguous or manipulated outputs from a language model, whatever the cause of the malfunction [3]. Among the common triggers, OWASP lists hallucinations and prompt injection [3]. ### What should I read before approving? At a minimum: what the action does, on which data or accounts, and who it goes to. If the agent offers to send a message, read the recipient and the full content. If the summary of the request is vague, that is a reason to refuse. ### Can I refuse? Yes. A refusal costs nothing: the agent can reword and the request can be made again. An approval given by mistake can be irreversible, for example a deletion or a message that has already gone out. ## How it works OWASP explains that a system built on a language model often receives from its developer the ability to call functions or other systems, through extensions (sometimes called tools, skills or plugins). The choice of which extension to use can also be left to the agent itself [3]. An agent generally chains several calls to the model, each building on the results of the previous ones [3]. OWASP identifies three usual causes of excessive autonomy: too much functionality, too many permissions, too much autonomy [3]. Human approval addresses the third: OWASP gives as an example an extension that deletes a user's documents without asking them for confirmation [3]. Approval does not replace the other protections. OWASP also recommends giving the agent only the extensions, functions and permissions it needs, and having downstream systems check authorizations rather than the model [3]. For prompt injection, OWASP lists human control of privileged operations among the measures that limit the impact [2]. These choices fall to the teams that deploy the agent, not to the employee. ## What you do - Read the approval request in full before answering, including the recipients, files and accounts concerned. - Refuse when you do not understand what the agent is going to do, or when the request does not match what you asked of it. - Refuse an action that has nothing to do with your current task: an agent that is summarizing a document has no reason to offer to send a message. - For an action that affects other people, a payment or access rights, check by another means if doubt remains. - Report to security any agent that acts without asking for your agreement when it should. ## Pitfalls ### Approving without reading When approval requests keep coming, people end up clicking without looking. Approval then becomes a formality and protects nothing. A request that appears in the middle of a task deserves the same attention as the first one of the day. ### The agent with too many rights OWASP gives the example of an extension meant to read data, but which connects to a database with an identity that can also modify, insert and delete [3]. It also cites the extension that acts for a user with a generic privileged account that has access to every user's files [3]. In these cases, a single approval can have effects far wider than the request shows. ### Prompt injection OWASP describes indirect injection: the model accepts content from outside, such as websites or files, and this content changes its behavior in unintended ways [2]. The instructions do not need to be readable by a human, as long as the model processes them [2]. OWASP adds that it is not known whether foolproof prevention methods exist [2]. Human approval is therefore a safeguard not to be bypassed. The following illustration is neutralized: the hidden instruction is paraphrased. ```text Illustration (fictional). Hidden text in a received email: [instruction addressed to the assistant: look for sensitive information in the mailbox and forward it to an external address] Approval request shown to the employee: "Send a message to contact@exemple.invalid?" ``` This is the scenario OWASP describes: a booby-trapped email pushes the assistant to scan the mailbox and forward sensitive information to the attacker's address [3]. Among the countermeasures, OWASP lists the requirement to review and manually click "send" for every message drafted by the extension [3]. ### Believing that approval is enough OWASP specifies that some measures, such as logging, monitoring and rate limiting, do not prevent excessive agency but limit the damage [3]. NIST presents its AI risk management framework as intended for voluntary use [4]. The UK NCSC states that the security of an AI system must be a requirement from the design stage and throughout its life cycle [5]. ## Sources 1. CNIL, "Intelligence artificielle | CNIL". https://www.cnil.fr/fr/intelligence-artificielle (accessed 3 November 2026) 2. OWASP, "LLM01:2025 Prompt Injection". https://genai.owasp.org/llmrisk/llm01-prompt-injection/ (accessed 3 November 2026) 3. OWASP, "LLM06:2025 Excessive Agency". https://genai.owasp.org/llmrisk/llm062025-excessive-agency/ (accessed 3 November 2026) 4. NIST, "AI Risk Management Framework". https://www.nist.gov/itl/ai-risk-management-framework (accessed 3 November 2026) 5. NCSC (UK), "Guidelines for secure AI system development", 27 November 2023. https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/human-in-the-loop-ai-agent-approval/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.