When should an AI agent require human approval?

An AI agent should require human approval **before a proposed action crosses a meaningful risk, authority, or reversibility boundary**.\n\nApproval is normally appropriate for:\n\n- sending external communications;\n- purchases, payments, refunds, or financial commitments;\n- deletion or destructive modification;\n- production deployment or merge;\n- permission, identity, or security-setting changes;\n- disclosure of confidential or personal information;\n- access outside the agent's normal sandbox;\n- use of a new network destination;\n- legal, medical, employment, or safety-critical decisions;\n- actions with uncertain targets, arguments, or consequences.\n\nLow-risk, reversible actions inside a tightly bounded workspace can usually proceed without repeated approval. The approval must show the exact action, target, arguments, data to be shared, and expected consequence.

Human approval is most useful when it controls authority rather than merely interrupting the workflow. Asking “continue?” after every harmless step creates approval fatigue and encourages automatic clicking. Asking immediately before a consequential, specific action creates a meaningful control.\n\nA risk-based approval policy can consider:\n\n1. **Impact** — how much harm could occur?\n2. **Reversibility** — can the action be reliably undone?\n3. **Externality** — does it affect another person or system?\n4. **Data sensitivity** — will confidential information be accessed or transmitted?\n5. **Financial or legal commitment** — does it bind the user or organisation?\n6. **Privilege** — does it alter permissions or use elevated credentials?\n7. **Novelty** — is the target, domain, or tool unfamiliar?\n8. **Confidence and ambiguity** — is the intent or target uncertain?\n9. **Scale** — will the action affect one item or thousands?\n10. **Evidence** — has the action been validated by tests or independent checks?\n\nThe OpenAI Agents SDK implements human-in-the-loop execution by pausing before tools marked as requiring approval, serialising the run state, recording the proposed tool name and arguments, and resuming after a person approves or rejects the specific call. This is stronger than an informal chat message because the pending action is bound to a tool-call identity.\n\nApproval should be **state-bound**. If the target resource, arguments, price, diff, permission set, or underlying state changes after approval, the approval should no longer be valid. Broad approvals such as “allow all future shell commands” should be limited to low-risk sessions and protected environments.\n\nThe reviewer needs enough information to make a real decision:\n\n- what the agent intends to do;\n- why it believes the action is necessary;\n- the exact target and parameters;\n- which information will leave the system;\n- relevant validation results;\n- whether the action can be reversed;\n- the consequences of rejection.\n\nHuman oversight does not guarantee safety. Reviewers can misunderstand technical output, become fatigued, or approve under time pressure. High-impact actions should therefore also use deterministic controls, least privilege, rate and value limits, separation of duties, logs, and post-action monitoring.

- [OpenAI Agents SDK — Human in the loop](https://openai.github.io/openai-agents-python/human_in_the_loop/) — documents pausing, inspecting, approving, rejecting, serialising, and resuming sensitive tool calls. - [OpenAI — Running Codex safely](https://openai.com/index/running-codex-safely/) — describes combining sandboxes with approval policies so higher-risk actions stop for review. - [NIST AI RMF — Human-AI interaction](https://airc.nist.gov/airmf-resources/airmf/appendices/app-c-ai-risk-management-and-human-ai-interaction/) — states that human roles, responsibilities, and oversight configurations should be clearly defined. - [OpenAI — Understanding prompt injections](https://openai.com/safety/prompt-injections/) — recommends confirmation before consequential actions and careful review of the exact proposed action. - [OpenAI Agents SDK — Run state](https://openai.github.io/openai-agents-python/ref/run_state/) — defines a durable state snapshot that preserves interruptions and approval decisions across resumed runs.