Human-in-the-Loop AI Agents: Where the Approval Step Belongs
What does human-in-the-loop mean for an AI agent?
A human-in-the-loop agent does the work up to a defined point and then stops for a person to approve, correct or reject it. The approval step is not a sign that the agent is weak. It is the part of the design that decides what the agent is allowed to change on its own, and it is often the reason a business is willing to connect an agent to live systems at all.
The hard question is not whether to have approval steps, but where to put them. With too many, the agent saves no time. With too few, a single wrong action can move money or reach a customer before anyone notices.
Which actions should always need approval?
A useful starting rule: the agent may read freely within its permissions, may prepare anything, and may only commit actions that are easy to reverse. Actions that are hard to reverse wait for a person.
| Action type | Example | Starting default |
|---|---|---|
| Read | Look up an order, a customer record or a policy | Agent acts alone |
| Draft | Prepare a reply, a journal entry or a quote | Agent prepares, a person reviews before it is sent |
| Reversible write | Tag a ticket, update a status, add a note | Agent acts alone, every action logged |
| Money or records | Post an invoice, issue a refund, change master data | A person approves |
| External message | Email or message a customer or supplier | A person approves until trust is earned |
The table is a default, not a law. A refund below a limit you set may be safe to automate once the agent has a track record. A status change that triggers a shipment may need approval from day one. Decide per action, write the decision down, and review it.
How does the agent decide when to ask?
There are two triggers, and a well-designed agent uses both.
- The action itself. Some actions always wait for a person, however confident the agent is, because of what they change.
- The agent's confidence. For everything else, the agent works against a threshold. When the input is unusual, a field is missing or two sources disagree, it routes the case to a person with the reason attached instead of guessing.
The second trigger only works if the threshold is tested. Build an evaluation set from real past cases, including the awkward ones, and check how the agent behaves on it before release. When a mistake reaches production, add that case to the set so the same error is caught by a test next time.
What should the reviewer see?
An approval step is only as good as the screen the reviewer works in. If the reviewer has to open three systems to check the agent's work, they will either slow down or start approving without looking. Give them, in one place:
- The original input, such as the email, the PDF or the ticket
- What the agent proposes to do, in plain language
- The records it looked up and the rule it applied
- Why the case was routed to them, if it was an exception
- One action to approve, one to correct, and one to reject with a reason
Corrections are valuable. Record them, because they show where the agent's rules or instructions need work.
How do you reduce approvals without losing control?
Start with more approval than you think you need. For each action type, track how often reviewers approve without making changes. When an action is consistently approved unchanged over a meaningful period, and the cost of an error is low, consider letting the agent commit it alone while keeping the log and reviewing a sample. Move one action type at a time, and keep a documented way to switch approval back on. Payments, ledger postings and messages to customers are the last candidates to move, and many businesses keep them behind approval permanently.
This is slower than switching everything on at once, and that is the point. Trust in an agent is built one action at a time, with evidence.
What records should every agent run keep?
For each run, keep the input, the tools the agent called and what they returned, the output, and who approved it and when. This audit trail is what lets you answer a customer, an auditor or your own finance team when they ask why something happened. It is also how you find and fix the cases where the agent is wrong.
Where should you start?
Approval design is easiest when the agent's job is narrow. If you are still choosing that job, start with our guide to which process to automate first. To see how we scope agents, set permission boundaries and build evaluation sets, read about our custom AI agents service. Our security page explains how we handle data and access.
Approval steps work best alongside tight access limits; see what data an AI agent should be able to see.
Questions about what happens when an agent gets something wrong are answered in our FAQ. If you would rather talk it through, get in touch.