How to Add Human Approval to AI Agents Without Killing Speed

Human approval is a design decision, not a warning dialog bolted on at the end. Tier your agent actions: let reversible work run unattended, and pause anything expensive or irreversible until a person decides.

TL;DR

• Tier agent actions by reversibility and cost, and send only the risky ones to a human.
• The OpenAI Agents SDK declares approval needs on the tool and surfaces pending calls as interruptions.
• Callable approval rules fail closed, so malformed arguments go to manual review.
• MCP elicitation has form and URL modes, and secrets must use URL mode.
• The CMA expects a human actively checking agent decisions, so build the review into the product.

Disclosure: ZeroRaised publishes this guide and is a launch site for bootstrapped products. Facts come from the linked sources as checked on 1 Nov 2026; ZeroRaised has no commercial relationship with the companies named. This is not legal advice.

Human in the loop is a control pattern where an agent pauses before a sensitive action and waits for a person to approve or reject it, then continues only after a recorded decision.

Which agent actions need human approval?#

Sort actions into three tiers before writing code.

• Run freely: reads, searches, summaries, drafts and anything a user can undo in one click.
• Notify and run: low-value writes that are easy to reverse, such as tagging a record or creating a draft invoice, with a visible log and a quick undo.
• Pause for approval: refunds, payments, deletions, contract or price changes, outbound messages to customers and anything that touches another person's account.

The test is not how clever the action is, but what happens if the agent is wrong. A wrong summary wastes a minute. A wrong refund costs money and may be hard to claw back.

How does the OpenAI Agents SDK pause a run?#

The SDK treats approval as part of the tool definition. The human-in-the-loop flow pauses agent execution until a person approves or rejects sensitive tool calls, tools declare when they need approval, and run results surface pending approvals as interruptions (OpenAI Agents SDK).

You can set needs_approval to True to always require approval, or pass an async function that decides per call. That function receives the run context, the parsed tool parameters and the tool call ID, which is enough to require approval only for refunds above a threshold and let small ones run (OpenAI Agents SDK).

Two details matter for production. Approvals apply run-wide, including tools on handed-off or nested agents, and some tool types support programmatic approval callbacks (OpenAI Agents SDK). RunState lets you serialise a paused run and resume it later, and the docs cover long-running approvals, keeping approval state on the server, recovering after a crash and custom rejection messages (OpenAI Agents SDK).

That is the difference between a demo and a product. If approval state lives only in memory, a deploy or crash loses the pending decision.

What does fail closed mean in practice?#

Callable rules fail closed. If the arguments are missing, empty, malformed or not an object, the call requires manual approval (OpenAI Agents SDK).

This is the right default even if you do not use the SDK. A parser that returns null on a bad payload should not be read as nothing to approve. It means a human needs to look at this.

The guide to evaluating LLM output covers the validation side, and the sandboxing guide covers limiting what the agent can reach while a decision is pending. If your agent reads untrusted text, the prompt injection guide explains why an injected instruction should never be able to approve itself.

How does MCP elicitation handle approval and sensitive data?#

The Model Context Protocol gives servers a way to request information from users through the client. Elicitation has two modes: form mode, for structured data with an optional JSON schema, and URL mode, which directs users to an external URL for sensitive interactions that must not pass through the MCP client, such as auth flows, payment processing and API keys (MCP specification).

The rules are explicit. Servers must not use form mode to request sensitive information such as secrets and credentials, and must use URL mode instead. Clients must respect user privacy and provide clear decline and cancel options, and responses carry an action such as accept (MCP specification).

For a small team, use form mode for a quick confirmation and send anything involving credentials or payment to a secure URL in URL mode, so it never passes through the MCP client. The MCP server guide covers the server side, and the guide to MCP tasks and elicitations covers longer-running interactions.

What does the CMA expect from a human in the loop?#

The UK Competition and Markets Authority published guidance on AI agents on 30 October 2026. It says to check that agents deliver the right results, behave as intended and comply, notes that AI can hallucinate, and asks businesses to make sure there is a human in the loop actively checking that the agent is making correct decisions and generating expected results (the CMA guidance).

It also says to refine quickly if outcomes are or may be non-compliant, with more urgency when large numbers of people or vulnerable customers are affected (the CMA guidance). The guidance applies the same consumer rules to AI and human agents, so a paused action still has to end in a correct decision. The CMA checklist post walks through the wider duties.

This is a summary of published guidance, not legal advice, and it does not mean any company has broken the law. Read the guidance before changing a consumer-facing flow.

A tiered approval policy for small teams#

1. Write the action list. Name every tool the agent can call and mark each one run, notify or pause.
2. Set the default to pause. Opt actions into automation deliberately, never by omission.
3. Encode thresholds in code. Put thresholds next to the tool, not in a prompt: refunds under a fixed amount can run, and anything above pauses.
4. Keep approval state on the server. A pending decision should survive a restart.
5. Show the person what will happen. Display the tool name, the arguments and the expected effect, not just a yes button.
6. Record the decision. Who approved, when, what they saw and what happened next.
7. Review the pauses weekly. An action that pauses constantly means the threshold is wrong or it should not be automated.
8. Route urgent approvals to a named person, because slow approvals invite workarounds.

The guide to AI agent monitoring covers the logging behind steps six and seven.

Where ZeroRaised fits#

ZeroRaised is a launch and discovery site for products built without institutional venture capital or accelerator equity. If you ship an agent, submit your product and explain which actions a human approves, because a clear approval policy is a trust signal buyers can check. The newsletter carries new analysis like this, and the pricing page explains the listing options. We make no promise of traffic or results.

Sources#

• OpenAI Agents SDK: human-in-the-loop
• Model Context Protocol: elicitation
• CMA: Complying with consumer law when using AI agents