Control · C-023 · Human Oversight & Contestability

Approval gates for high-impact agent actions

Before an agent takes an action above a defined impact threshold, or one that cannot be reversed, a designated person reviews the exact action and approves or rejects it.

Control type: Preventive
Family: 09 Human Oversight & Contestability
Risks addressed: 8
Audience: Heads-of · Practitioner
Frameworks: Article 14 · AML.M0029 · ASI02 · LLM03
Responsible AI domain: 09 Human Oversight & Contestability
Lifecycle stage: 3 Design & build
5 Approve
7 Operate & monitor
Reviewed: 2026-11-10

What it does

It places a human decision between an agent's intention and its effect, for the actions where a mistake matters most. It limits the consequence of every upstream failure: a hijacked goal, a misused tool or a fabricated parameter still has to pass a person who can see what is about to happen. The business owner of the process sets the threshold; the gate operates on every action above it.

How to implement it

Classify each tool operation by impact and reversibility, and set the threshold with the business owner.
Show the approver the action itself: the operation, target and parameters, alongside the agent's stated reason.
Route approval to someone with the authority and knowledge to refuse.
Make rejection as easy as approval, and record both with a reason.
Fail closed: if no decision arrives, the action does not proceed.

Evidence it operates

Design: a register of gated operations with thresholds, each approved by the business owner. Operation: for a sample of gated actions, an approval record that predates execution and names the approver; a non-trivial rejection rate; and results of periodic tests in which seeded bad requests were refused.

Where it fits

Set at design, confirmed at approval for release, operated in production. It depends on least-privilege agent identity to ensure the agent cannot reach the operation by another route, and on agent action tracing for the record.

Limits

It does not help with actions below the threshold, or with harm built from many small actions. Its value falls as volume rises and approvers stop reading; see human-agent trust exploitation.

Risks this mitigates

Primary mappings

Agent goal hijack High: A hijacked plan still needs approval before a high-impact action. Injected or poisoned content redirects an agent's objective or plan, so the agent pursues an attacker's goal with the organisation's authority and access.
Agent tool misuse High: Holds destructive or irreversible tool calls for approval. An agent uses a tool it is permitted to use in an unsafe or unintended way, such as a destructive command or a wrong parameter, causing data loss, unauthorised transactions or disruption.
Cascading failures in agent workflows High: Places checkpoints that stop propagation before high-impact steps. An error or compromise in one agent or step propagates through chained agents and automated workflows faster than people can notice or intervene.
Excessive agency in autonomous agents High: Requires human approval for high-impact or irreversible actions. An agent is given more functions, permissions or independence than its task requires, so an error, an ambiguous instruction or a manipulated input turns into a damaging action that no one approved.
Human-agent trust exploitation Medium: Presents approvals with the full context needed to refuse. People approve an agent's request or accept its account of events because it is fluent and familiar, so the human check that was meant to stop a harmful action passes it instead.
Unauthorised commitments by agents High: Requires human approval before an agent makes a binding statement or transaction. An agent makes a statement, offer or transaction that binds the organisation, without the authority a person in the same position would need.

Supporting mappings

Inadequate human oversight design High: Requires approval before high-impact actions. An AI system is built with no human oversight, or with an oversight step that lacks the time, information, competence or authority to change an outcome.
Unexpected code execution by agents Critical: Requires approval for execution outside the sandbox. An agent generates and runs code or commands that were never reviewed, allowing injected instructions or model error to execute on the host or in connected systems.

Framework and clause references

Framework	Clause	Title
EU AI Act	Article 14	Human oversight Oversight.
MITRE ATLAS	AML.M0029	Human In-the-Loop for AI Agent Actions The corresponding mitigation.
OWASP Top 10 for Agentic Applications	ASI02	Tool Misuse and Exploitation Tool misuse.
OWASP Top 10 for LLM Applications	LLM03	Excessive Agency Excessive agency.

Related terms

How to cite

Axiom Verity (2026). Approval gates for high-impact agent actions. Reference Library, C-023. https://axiom-verity.com/controls/approval-gates-for-agent-actions. Reviewed 2026-11-10.

Found an error or a better source? Report a correction.