Human approval for AI agents: review the exact action

Approval is a product interaction

“Allow the agent to continue?” gives a reviewer almost nothing to work with. Show the recipient, message and attachments before an email goes out. Show the old and new values before a record changes. Approval should be a decision about one action, not a vote of confidence in the entire conversation.

The reviewer also needs enough context to reject the proposal. Which evidence supports the change? What happens if it is denied? Can the task remain a draft? Treat approval as an operational decision with a clear consequence, not as a decorative checkpoint added after the system is already committed to an action.

Bind consent to a stable payload

Approval should apply to a particular normalized action. If the agent changes the recipient after approval, the original approval no longer describes what will happen. Store the approved payload or a verifiable fingerprint alongside the decision, reviewer identity, time and expiry. Recheck that binding immediately before execution.

This is especially important for workflows that pause for minutes or hours. The destination record, user permissions or task context may change during the pause. A stale approval should not override a current access check. The action executor remains responsible for enforcing policy even when the interface displays an approved state.

Route the request to an accountable reviewer

Choose reviewers based on the business process and permitted authority. A random person available in a chat channel may not own the decision. Avoid exposing sensitive content to a broad group merely because the approval tool integrates with that group. Keep the notification short and link to an appropriately protected review surface when the full payload is restricted.

n8n documents selected-tool review, while Flowise documents resumable human checkpoints. These are implementation mechanisms to evaluate. They do not establish your organization’s approval rules, data classification or authorization policy. Check the exact product version and deployment behavior before relying on a checkpoint during a restart.

Handle denial and expiry deliberately

A denied action should not trigger a creative workaround that achieves the same external effect through another tool. Return a clear denial category to the workflow and define allowed next steps: clarify, revise a draft, stop or escalate. Expiry should likewise stop the action until the proposal is reviewed again.

Maintain a visible unresolved queue. Include task age, owner and the next safe operation. If an approved action times out, reconcile the destination before asking the reviewer to approve another attempt. Otherwise, a reviewer can unknowingly authorize a duplicate effect.

Evaluate the complete interaction

Test a correct approval, a denial, an expired approval, changed arguments and a reviewer whose permissions were revoked. Assert the external state, not only the final assistant message. Include a case where the model is instructed by retrieved text to bypass the review step. The executor should reject that request independently of the model’s response.

Use the agent workflow planner to write the initial brief. Combine it with the security guide and retry design. A good approval flow makes the consequential decision understandable while retaining a clear technical enforcement boundary.

Implementation map

Sources and limits

n8n human review; Flowise AgentFlow V2. Documentation checked October 14, 2026. Recommendations and worked examples are editorial methods, not claims of a completed client engagement.