Add Human Approval Gates to an Agent Workflow

A state-based workflow map showing what the agent may read, transform, propose, approve, and act on, including rollback and evidence for every consequential step.

Operators automating recurring work with agents, scripts, schedulers, or connected tools.

• Current workflow steps
• Data classifications
• Possible external actions
• Cost and reputational stakes
• Approval owners and response times
• Rollback or recovery options

1. Map states, not intentions

   Write each step as READ, TRANSFORM, JUDGE, PROPOSE, APPROVE, ACT, VERIFY, or RECOVER. Name the artifact passed between states.

2. Classify the consequence

   For every ACT state, identify who or what changes, whether it is reversible, what it costs, and what private material it touches.

3. Place the gate before the edge

   Require approval before sending, publishing, deleting, paying, deploying, changing permissions, or making a consequential external write—not after.

4. Design the review packet

   Show the proposed action, exact target, evidence, uncertainty, changes since last review, and approve/edit/reject choices. Do not make the reviewer reconstruct context.

5. Specify timeout and failure behavior

   No response should default to no action. Record escalation, expiration, deduplication, and safe retry rules.

6. Verify the whole loop

   Test approve, edit, reject, timeout, duplicate trigger, tool error, partial action, and recovery with synthetic data.

• A workflow state table
• HumanGate or another review inbox concept
• Synthetic test records
• Execution logs and receipts
• Rollback instructions

• Workflow owner approves authority classifications
• Data owner approves private-data handling
• Named reviewer approves each consequential action
• System owner approves changes to permissions or automation schedules

• No response means no action
• A stale approval expires instead of carrying forward
• A changed target or payload invalidates the prior approval
• A partial external action stops retries and opens recovery review
• A tool error records evidence without silently skipping the gate

• □Every consequential action has a gate before it
• □The reviewer sees exact target, payload, evidence, and uncertainty
• □Approve, edit, reject, timeout, and duplicate cases are tested
• □Approval receipts cannot be confused with execution receipts
• □Rollback exists where technically possible
• □The agent cannot broaden authority from positive feedback or prior approval

Design human approval gates for this agent workflow.

Workflow steps: [list]
Data involved: [public, private, confidential, credentials]
External actions: [send, publish, delete, pay, deploy, change records]
Approval owners: [roles]
Reversibility and rollback: [details]
Maximum acceptable delay: [time]

Map every step as READ, TRANSFORM, JUDGE, PROPOSE, APPROVE, ACT, VERIFY, or RECOVER. Place a human gate before every external, destructive, costly, permission-changing, privacy-crossing, or difficult-to-reverse action. Define the review packet, expiration, no-response behavior, duplicate handling, partial-action recovery, and evidence receipt. Produce synthetic tests for approve, edit, reject, timeout, tool failure, and retry.

Synthetic example

Scenario

An agent prepares newsletter recommendations from public sources and email subscriptions.

Input

Read-only discovery, a draft recommendation, possible unsubscribe action, and a Matter forwarding option.

Result

The agent may read and draft automatically. Unsubscribe and forwarding become separate proposed actions with exact senders, sample evidence, and approval IDs. No response does nothing; changed sender scope invalidates approval; execution gets a separate receipt.