How to Add Human Approval Before an AI Agent Takes Action
A practical human-in-the-loop pattern for blocking refunds, emails, purchases, deployments, and other consequential AI-agent actions until an explicit decision.
Short answer
Create a short-lived approval request that clearly describes the proposed action, deliver the private review link to the intended reviewer, and keep the agent blocked until the status is exactly approved.
The failure this prevents
A model can recommend a refund or deployment, but it should not infer that recommendation is authorization. Human authority must be represented by state outside the model and checked immediately before execution.
Recommended workflow
- Describe the action in language the reviewer can evaluate, including material amounts and targets.
- Create the approval request and protect the returned approval URL like a temporary secret.
- Deliver the link through your own trusted channel.
- Poll the approval state and continue only when status is exactly approved.
- Re-check business authorization and acquire an idempotency lock immediately before execution.
Working starting point
curl https://api.scrubmytext.com/v1/approvals/request \
-H "Authorization: Bearer smt_live_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"title":"Refund customer $725","description":"Duplicate payment for order 82731.","expires_in_seconds":3600}'Relevant product: ApproveMyAction · REST + MCP
Decision rule
Pending, rejected, expired, cancelled, missing, and error responses all mean stop. Approval is evidence of a link-holder’s decision, not proof of identity, legal authority, execution, or outcome.
Good fit
- A person must review the exact proposed action.
- The agent may be offline while the decision is pending.
- You need explicit approved, rejected, expired, and cancelled state.
Use another approach when
- The action is routine, reversible, and already covered by an enforceable policy.
- You need verified organizational identity or multi-party authorization; add your identity layer or a quorum.
- You cannot securely deliver the private approval link.
Options compared
| Option | Strength | Important limitation | Best fit |
|---|---|---|---|
| Chat message saying “approved” | Familiar to users | Hard to bind to exact action and expiry | Conversation, not enforcement |
| Custom approval database | Maximum customization | You own token security, expiry, UI, state, and testing | Core product workflows |
| ApproveMyAction | Hosted short-lived decision state through REST and MCP | Caller delivers the link and verifies reviewer context | Fast agent integration |
| Quorum control | Multiple distinct decision slots | More reviewer friction | Higher-consequence actions |
Implementation cautions
- Never place bearer approval tokens in analytics or logs.
- Bind the displayed request to the action the agent will actually perform.
- Add idempotency so one approval cannot accidentally produce duplicate execution.
Frequently asked questions
Does ApproveMyAction send the approval link?
No. The calling application chooses and operates the delivery channel.
Can the model approve its own request?
That defeats the purpose. Keep decision authority outside the requesting agent.
What should happen after approval?
Re-check authorization and policy, acquire an idempotency lock, execute once, and record the outcome.
Related decisions
Next step
Use the product page for exact limitations and access requirements, then copy the corresponding REST or MCP workflow.