Guides
Human in the loop for AI agents: which actions need approval?
An AI agent that only answers questions is low risk. Once it creates orders, changes tickets or sends messages on your behalf, you want a person to check the actions that matter. This guide explains which actions those are, what the law says, and how to set up approval so it protects you without slowing everything down.
Short answer
Let an agent read freely within its rights, and let a person approve actions that are hard to undo or have impact outside your company: orders, financial changes, closing tickets, messages to customers. The AI Act only requires human oversight for high-risk systems, which a typical sales or service agent is not by that fact alone. The reason to do it anyway is OWASP's risk of excessive agency.
What does human in the loop mean for an AI agent?
Human in the loop means the agent prepares an action, but a person approves, changes or rejects it before it is carried out. The agent does the work of collecting and filling in; the person keeps the decision. It is different from monitoring afterwards, where you review what already happened.
Most agent platforms build this in. n8n can require approval before an AI agent runs a specific tool, and shows the reviewer which tool the agent wants to use with which input. The OpenAI Agents SDK pauses on tool calls marked as needing approval. The MCP specification says there should always be a human in the loop with the ability to deny tool calls.
Sources
- n8n docs: human review for AI agent tools (docs.n8n.io)
- OpenAI Agents SDK: human in the loop (openai.github.io)
- MCP specification: tools (modelcontextprotocol.io)
Which actions should an agent not take on its own?
Actions with high impact: they are hard to undo, cost money, or reach customers and suppliers. OWASP calls the lack of approval for such actions excessive autonomy, and advises human approval for high-impact actions. n8n names deleting data, sending external communication and making purchases as typical examples.
| Action | Example | Risk | Starting point |
|---|---|---|---|
| Reading and answering | Order status, stock, a manual | Low, within the agent's rights | No approval; rights per role and logging |
| Preparing a record | A draft quotation, a filled-in ticket | Low, nothing is final yet | No approval for the draft; approval before it becomes final |
| Creating or updating in ERP | A sales order, a purchase order, a price | High: affects stock, finance and suppliers | Approval by a colleague |
| Closing or completing | Closing a ticket, processing an order | High and often irreversible | Approval by a colleague |
| Sending externally | An email to a customer, a message to a supplier | High: reaches outside your company | Approval, unless it is a fixed, agreed message |
| Bulk actions | 100 invoices or orders in one run | Very high: one mistake repeats | A proposal with counts and totals, approved as a batch |
Sources
- OWASP Top 10 for LLM Applications 2025: Excessive Agency (genai.owasp.org)
Does the law require human approval?
Only in specific cases. The AI Act requires human oversight for high-risk AI systems, such as AI that screens job applications. An agent for order status, quotations or service tickets is not high-risk by that fact alone. The GDPR gives people the right not to be subject to solely automated decisions with legal or similarly significant effects, with exceptions.
This is general information, not legal advice. Whether a specific agent is high-risk depends on its purpose; have that assessed if your agent decides about people, such as job applicants or credit.
- AI Act, Article 14: high-risk systems must be designed so that people can oversee them effectively, understand their limits, stay aware of automation bias, override the output and stop the system.
- AI Act, Article 26: deployers of high-risk systems assign oversight to people with the necessary competence, training and authority, and keep logs for at least six months where those are under their control.
- Dates: since the Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026, these rules apply from 2 December 2027 for high-risk systems under Annex III and from 2 August 2028 for those under Annex I.
- AI Act, Article 4 as amended by Regulation (EU) 2026/1744, for every AI system: providers and deployers take measures to support the AI literacy of the staff who work with it.
- GDPR, Article 22: a person may not be subject to a decision based solely on automated processing with legal or similarly significant effects, unless an exception applies. For the exceptions of contract and explicit consent, they keep at least the right to human intervention, to give their view and to contest the decision.
Sources
- EUR-Lex: AI Act, Regulation (EU) 2024/1689 (eur-lex.europa.eu)
- EUR-Lex: Digital Omnibus on AI, Regulation (EU) 2026/1744 (eur-lex.europa.eu)
- EUR-Lex: GDPR, Regulation (EU) 2016/679 (eur-lex.europa.eu)
How do agent platforms arrange approval?
Every major platform offers a way to pause an agent for a person, but you configure it yourself, per tool or per flow. The defaults differ: some ask by default, others run tools automatically. Check what your platform does before you connect it to a system that writes.
| Platform | What it offers | Note |
|---|---|---|
| Microsoft Copilot Studio | Request for information in agent flows; multistage approvals with human and AI stages | Requests go via Outlook; multistage approvals are in preview |
| OpenAI Agents SDK | Approval required per tool, always or per call | Falls back to manual approval when arguments cannot be inspected safely |
| Claude Managed Agents | Per toolset or tool: always allow, always ask, or auto (the server decides per call) | Beta; MCP tools ask by default, built-in tools run automatically |
| n8n | Approval before a tool of the AI Agent node runs, via chat, Slack, Teams, email or WhatsApp | For all tools or selected ones |
| Zapier | Human in the Loop step: approve, decline or edit | Premium app; on Pro only requests to yourself |
Sources
- Microsoft Learn: request for information in agent flows (learn.microsoft.com)
- Microsoft Learn: multistage and AI approvals (learn.microsoft.com)
- Claude docs: permission policies (platform.claude.com)
- Zapier help: Human in the Loop (help.zapier.com)
How do you set up approval that works?
Combine approval with limits that do not depend on the agent: minimal rights in the connected system, a fixed list of allowed actions, and a log of everything. Show the reviewer exactly what will happen. Start strict and loosen only where the agent has proven itself.
01
Give minimal rights
OWASP advises limiting the agent's rights in other systems to the minimum, and checking authorisation in those systems instead of letting the model decide.
02
Decide per action
Use the table above: reading free, high-impact actions to a person. Write down who approves what.
03
Show the exact action
The reviewer sees the customer, the items, the amounts and the source conversation, not a summary. That keeps approval a real check.
04
Watch for automation bias
The AI Act names the tendency to rely too much on AI output. Rotate reviewers and sample approved actions.
05
Start strict, then loosen
n8n advises starting with human review and reducing oversight as confidence grows. Loosen per action, based on the log.
How does BeeManaged arrange approval?
Agents start read-only. Rights are set per role, with a dedicated account per connected system. Actions that change records in ERP, finance or service desk wait in the approval queue in app.beemanaged.com until a colleague approves. You decide who approves what, and every question and action is recorded in the audit log.
- Bulk actions, such as invoicing many orders in Exact Online, first show a proposal with counts and totals; nothing is created until someone approves the batch.
- Per process we agree which actions need approval and who approves them. Every action is recorded in the audit log.
- With our monitoring service, conversation review and the monthly report show where an approval step can be loosened or should be tightened.
Updated · As of October 2026 · Author Roy Rutten, AI architecture and development
Frequently asked questions
What is human in the loop?
A setup in which an AI agent prepares an action and a person approves, changes or rejects it before it is carried out.
Does the AI Act require human approval for every AI agent?
No. Human oversight under Article 14 applies to high-risk AI systems, from 2 December 2027 for Annex III systems. A customer service or order status agent is not high-risk by that fact alone.
Which actions should always be approved?
Actions that are hard to undo, cost money or reach outside your company: orders, financial changes, closing tickets and messages to customers or suppliers.
Doesn't approval make the agent slow?
Only for the actions you route to a person. Reading and answering stay instant, and the agent prepares everything so approval takes seconds. Loosen per action once the log shows it goes right.
Is an MCP connection enough to keep control?
Not by itself. The MCP specification says a person should be able to deny tool calls, but it cannot enforce that; whether and when a client asks depends on its settings.
Who approves at BeeManaged?
A colleague you appoint, per action type. Proposed actions wait in the approval queue in app.beemanaged.com, and every question and action is recorded in the audit log.
Want to know which actions in your process need approval?
Plan a conversation. We go through one process with you and mark which actions an agent can do itself and which ones a colleague should approve.