Human in the loop: approving AI actions

Approve the action, not just the plan

A polite question in the prompt is not a control mechanism. The system must pause execution, preserve the exact proposed action and resume only after an authorised person responds.

Actions that usually need a gate

• sending or publishing externally
• deleting or overwriting data
• moving money, ordering or creating cost
• changing access, identity or security settings
• using sensitive data or making consequential decisions about people
• running code or changing production systems

Show the decision evidence

Proposed action: [exact tool and arguments]
Purpose: [why it is needed]
Target: [system, recipient or data]
Consequence: [what changes if approved]
Checks completed: [tests, preview, cost]
Reversible: [yes/no and how]
Uncertainty: [what the reviewer should know]

Decision: Approve | Reject | Request changes

Avoid approval fatigue

Do not gate harmless read operations. Classify action types, show a useful preview and log who approved what. A generic continue button without a clear target and consequence invites rubber-stamping.

Combine gates with stopping conditions and tool permissions.

Sources

• Microsoft Learn: Human-in-the-loop workflows — pause, request, response and resumption
• Microsoft Learn: Tool approvals — approving or rejecting function calls
• NIST AI RMF Core — governance and risk-based control levels