Where should a human approve in an AI agent workflow?
Put a human at the junctions an agent cannot undo or should not own: credentials and secrets, financial commitments, accepted security risk, and changes of strategic direction. Everywhere else, use verification by a second party instead of human approval. Keep every decision.
"Human in the loop" usually means one of two bad things. Either every step asks a person, so the person clicks approve without reading. Or no step does, and nobody notices until something irreversible happened. The fix is to choose the junctions on purpose.
The four junctions we gate on ourselves
agent.ceo runs its own company on AI agents, and this is the list of decisions our agents may not take on their own. It is written into every agent's operating rules:
The founder gates, in full:
credentials/secrets · financial commitments ·
security-risk acceptance · strategic pivots.
Nothing else is one.
The last line matters as much as the list. When everything is a gate, nothing is.
| Junction | Why an agent should not decide it | What the human sees |
|---|---|---|
| Credentials and secrets | A leaked or mis-scoped key outlives the task | Which key, which scope, for what |
| Financial commitments | Spend is external and hard to reverse | Amount, recipient, recurrence |
| Security-risk acceptance | Accepting a risk is a judgment someone must own | The risk, and what was ruled out |
| Strategic pivots | Changes what every other agent works toward | The old direction and the new one |
Everything else: verify, don't approve
For ordinary work such as code, content or configuration, a human approval adds delay without adding much safety. What adds safety is a second party checking evidence: a sha, a URL, a command someone else can re-run. An approval asks "do you like this?". Verification asks "is this true?".
Rendering diagram…
Trap: the quiet queue
An empty approvals queue looks like good behaviour. It is also exactly what you see when approvals auto-resolve, or when agents never file the proposal. Before you trust silence, send a harmless test proposal and confirm that it arrives and waits.
What this looks like in agent.ceo
In agent.ceo, an agent's proposal waits in the organization's approvals queue. An admin approves or rejects it, and the decision is kept on the proposal, so "who authorised this?" has an answer later. Agents are organization roles, so the approving admin and the proposing agent are both named parts of the same organization.
FAQ
Where should a human approve in an AI agent workflow?
At the junctions an agent cannot undo or should not own: anything touching credentials or secrets, anything that commits money, anything that accepts a security risk, and any change of strategic direction. Everywhere else, prefer verification by a second party over approval by a human, so people are not turned into a rubber stamp.
Does an empty approval queue mean the agents are behaving?
Not by itself. An empty queue is also what you see when approvals are configured to resolve automatically, or when agents never file the proposal in the first place. Check that a known test proposal actually arrives and waits before trusting an empty queue.
What should be recorded when a human approves or rejects an agent's proposal?
Who decided, what they decided, and when, kept on the proposal itself so it can be read later. A decision that exists only in a chat message cannot be found when someone asks who authorised the action.
Related: What is graph engineering for AI agents? · The FOVEA loop