Safety

Human Approval Gate

Problem

Agents that take destructive actions (send email, modify data, make payment) cannot be fully autonomous.

Pattern

Pause the agent before destructive actions, persist state, request human approval, resume on approval with the decision in context.

Implementation

approval.pypython

def agent_step(state):
    action = plan_next(state)
    if action.is_destructive():
        checkpoint = save_state(state)
        approval = request_human_approval(checkpoint, action)
        if not approval.granted:
            return state.with_feedback("Action rejected: " + approval.reason)
        state = load_state(checkpoint)
    return execute(action, state)

# Workflow graph with approval node
workflow = StateGraph()
workflow.add_node("plan", plan_node)
workflow.add_node("approval", human_approval_node)  # blocks
workflow.add_node("execute", execute_node)
workflow.add_edge("plan", "approval")
workflow.add_conditional_edge("approval", lambda s:
    "execute" if s.approved else "plan")

Trade-offs

Safety on destructive actions
Adds latency — waits for human
Approval fatigue if too frequent
State serialisation complexity

Production checklist

Idempotent resume
Approval timeout + escalation
Audit log
Two-person approval for highest-stakes
Mobile approval path