How do I add human approval to AI agent actions?
Last updated · Written by the Bot Office team; it names Bot Office where it fits and says where it does not.
The short answer
Sort what the agent can do by risk, let the low-risk actions run, and make every risky action stop and wait for a named person to approve or reject it, with the decision recorded. For destructive or irreversible actions, require a second, different approver.
This is what security guidance asks for: OWASP lists "excessive agency" as a top risk for LLM applications and recommends human approval of high-impact actions, and the MCP specification says a human should be able to deny tool calls.
Steps (with any tool)
- List the actions and give each a risk tier. Reading data is low risk; sending email outside the company, refunds, deleting records or restarting production are not. Write the tiers down before the agent runs.
- Give the agent its own identity and only the actions its role needs. One credential per agent, scoped to its role, so you can see who asked and revoke one agent without touching the others.
- Make risky actions a request, not a call. The agent submits what it wants to do and why; the system holds it as "awaiting approval" and the agent polls or is told the result.
- Route the request to a person, where they already are. A link in Slack, Teams or email that opens the request, with an expiry, is faster than asking people to watch a dashboard.
- Use a two-person rule for the worst actions. Two distinct approvers (and, for irreversible actions, a typed confirmation) means one compromised or careless account cannot do the damage alone. NIST describes the same idea as two-person integrity.
- Keep the record. Who asked, what, why, who decided, when. That record is what an auditor or a client will ask for.
How Bot Office does it
In Bot Office a bot requests an action with POST /v1/in/actions (or the MCP tool perform_action) and a reason. Low-risk actions run at once; riskier ones wait for a person in the office; anything outside the bot's role is refused with the reason. The riskiest tier needs two distinct approvers and a typed confirmation.
The approval.requested alert can post to Slack or Teams with a decision link that expires within 24 hours; the link alone cannot approve, the approver's key does. Nothing runs in a system unless the owner connected it with their own credentials. See the role library, the security page and the agent guide.
Questions
Can the agent approve its own request?
It should not be able to. In Bot Office a bot link can request but never decide; deciding needs the office access code or an approver key.
What if nobody answers?
The request stays waiting and the agent can poll it; a decision link expires within 24 hours. Nothing runs by default.
Does this work with MCP agents?
Yes. The same rules apply to the MCP tools perform_action and check_action at https://aibotoffice.ai/mcp.
Sources
- OWASP Top 10 for LLM Applications: LLM06:2025 Excessive Agency
- MCP specification: tools (human in the loop)
- NIST glossary: two-person integrity
Facts about other products are from their own documentation, linked above, as read on the date at the top. Bot Office is not certified or endorsed by their makers.