How do you add human approval to an AI agent's actions?

Why isn't asking the agent to check with you enough?

An instruction to "ask before doing anything risky" depends on the agent deciding what's risky and remembering to ask. A real approval step is enforced outside the agent: the agent can request an action, but it has no way to carry the action out itself. The design question is always the same: what can the agent do on its own, and where does it have to stop and wait?

How do you approve the commands an agent runs?

Put a gate in front of the machine. Sandboxer's guide to requiring human approval before an agent runs a command builds one in about 150 lines of Python:

• The agent holds no Sandboxer key. It can only call a tool that sends commands to the gate.
• Commands on a short read-only allowlist run at once; anything else waits for a person's yes at a terminal or a local web page, and is denied if nobody answers.
• Only the gate holds a key, scoped to one sandbox with just the read and exec actions and a two-hour expiry. Actions like writing files, SSH or prompting an agent inside the sandbox are left out, because each would be a way around the gate.
• The agent and the gate run as different OS users, so the agent can't read the gate's key.

sbx history then shows any command that reached the sandbox without passing through the gate.

How do you approve an agent's releases?

With a cap the agent can't raise. Flagger.gg runs in auto-live mode by default, where agents' changes apply at once. Turning approvals on for a project changes that: new flags start off, and in production an agent can roll a flag out only up to a cap, 10% by default. Anything wider, or turning a flag on for everyone, becomes a request a person approves in the Release console, and requests expire after 72 hours. Agents have no approve tool, so they can ask but never sign off. A kill still works at once, because turning a feature off should never wait. See Flagger.gg's guide to human approval for agent flag changes.

How do you approve before money moves?

Make the payment wait on a person's check. On Transformer, a brand's agent can send offers, which cost nothing. The brand's card is charged only when a creator accepts, and the payment is held. It's released only after a person on the Transformer team reviews the creator's post and approves it with a reason. See pay on confirmed posts. For limits on spending itself, see how to stop an AI agent from overspending.

Which actions should need a person?

The ones that are hard to undo or that other people will see. At North Bay Ventures, only Jon approves spending money, legal terms, DNS changes, deletions and public launches, and an approval passed along by another agent counts only if it quotes his words. Routine work that is easy to reverse, like fixing a fact or a broken link, has a standing yes so it doesn't wait. Read how the studio uses agents.

How do you keep approvals from becoming a rubber stamp?

• Approve less, but meaningfully. Let reversible, low-risk actions through so people only see the decisions that matter.
• Show what will happen. The request should carry the exact command, flag change or amount, and the agent's reason. Flagger.gg requires a note on every agent write.
• Expire unanswered requests. A request nobody answered should be denied, not left open forever.
• Log every decision, so you can see later who approved what; see how to tell which AI agent made a change.