Guide · Agents
Human Approval for High-Impact AI Tool Calls
If an agent can refund customers, delete data, or page production without a human in the loop, you are past APRF Human Approval expectations for high-impact actions.
High-impact tool calls need a human gate—APRF Human Approval is a runtime hold, not a polite prompt. Primary control: Human Approval
Propose ≠ execute
Human approval (HITL) means a named person must confirm before the runtime runs a high-impact tool—refunds, deletes, outbound messages, admin APIs. The model may draft the call. The server returns `pending_approval` until someone with a real identity clicks yes.
"I'll ask the user" inside the chat transcript is not a gate. If the tool path can still fire, you failed Human Approval.
Label impact, then break the path
Classify every tool: low (auto-run under Tool Safety + AuthZ) vs high (never auto-execute in production). High-impact inventory is the input to policy. Without it, everything feels "probably fine" until finance reconciles a surprise refund storm—like an ops agent that honored manipulated ticket text and called `create_refund` with no hold.
When approval is required:
- Show arguments, blast radius, and evidence—not a naked Approve button
- Bind the approver (SSO / MFA for admin class)—no shared bot user
- Expire pending actions; never auto-approve on a timer
- Log proposal, approver, timestamp, outcome; use idempotency keys so double-approve does not double-charge
Break-glass exists for true emergencies and is noisy—not a quiet bypass.
Kill switch vs HITL
Kill switches stop the agent entirely (Agent Governance). HITL gates one dangerous action. Production agents usually need both: budgets and interrupt for runaway loops; human confirmation for irreversible side effects.
Assess against APRF Core
Run the Core Profile quiz — gated pass/fail blockers for AI production readiness, not a vanity score.
Related
Frequently asked questions
- Does every tool need human approval?
- No. Low-impact read-only tools can auto-run under Tool Safety and Authorization. High-impact side effects need HITL in production.
- Is confirming in the chat UI enough?
- Only if the server enforces the hold. A model saying "I will wait" is not a control.
- How does this relate to agent kill switches?
- Kill switches stop the agent entirely. Human approval gates individual high-impact actions. You usually need both.