Skip to content

human-in-loop-approval-framework.md

Latest commit

 

History

History
192 lines (147 loc) · 6.24 KB

human-in-loop-approval-framework.md

File metadata and controls

192 lines (147 loc) · 6.24 KB
title Human-in-the-Loop Approval Framework
status validated-in-production
authors
Nikola Balic (@nibzard)
based_on
Dexter Horthy (HumanLayer)
category UX & Collaboration
source https://claude.com/blog/building-companies-with-claude-code
tags
human-oversight
safety
approvals
risk-management
collaboration
slack-integration
slug human-in-loop-approval-framework
id human-in-the-loop-approval-framework
summary Systematically insert human approval gates for designated high-risk functions while maintaining agent autonomy for safe operations, with multi-channel approval interfaces and comprehensive audit trails.
updated_at 2026-01-05

Problem

Autonomous AI agents need to execute high-risk or irreversible operations (database modifications, production deployments, system configurations, API calls) but allowing unsupervised execution creates unacceptable safety and compliance risks. Blocking all such operations defeats the purpose of agent automation.

Solution

Systematically insert human approval gates for designated high-risk functions while maintaining agent autonomy for safe operations. Create lightweight feedback loops that enable time-sensitive human decisions without blocking the entire agent workflow.

Core components:

Risk classification:

  • Identify functions that require human approval
  • Define approval criteria (cost thresholds, data sensitivity, reversibility)
  • Categorize operations by risk level

Multi-channel approval interface:

  • Slack integration for real-time notifications
  • Email for asynchronous approvals
  • SMS for urgent/critical operations
  • Web dashboard for batch reviews

Approval workflow:

  • Agent requests permission before executing risky function
  • Human receives context-rich approval request
  • Quick approve/reject/modify decision
  • Agent proceeds or adapts based on response
  • Timeout handling with configurable escalation (default deny recommended)

Audit trail:

  • Log all approval requests and responses
  • Track who approved what and when
  • Enable compliance and debugging
sequenceDiagram
    participant Agent as AI Agent
    participant Framework as Approval Framework
    participant Slack as Slack Channel
    participant Human as Human Reviewer
    participant DB as Database

    Agent->>Framework: Request: DROP old_users table
    Framework->>Framework: Classify as HIGH RISK
    Framework->>Slack: Send approval request with context
    Slack->>Human: Notification with approve/reject buttons

    alt Approved
        Human->>Slack: Click "Approve"
        Slack->>Framework: Approval granted
        Framework->>Agent: Permission granted
        Agent->>DB: Execute DROP table
        Framework->>Framework: Log approval & execution
    else Rejected
        Human->>Slack: Click "Reject + provide reason"
        Slack->>Framework: Rejection + context
        Framework->>Agent: Permission denied + reason
        Agent->>Agent: Adapt plan (skip or find alternative)
    end
Loading

How to use it

When to apply:

  • Production database operations (DELETE, DROP, ALTER)
  • External API calls with side effects (payments, emails, webhooks)
  • System configuration changes (firewall rules, permissions)
  • Destructive file operations (bulk deletes, overwrites)
  • Compliance-sensitive operations (GDPR, HIPAA, SOC2)

Implementation examples:

Decorator pattern (HumanLayer):

from humanlayer import HumanLayer

hl = HumanLayer()

@hl.require_approval(channel="slack")
def delete_user_data(user_id: str):
    """Delete all data for user - requires approval"""
    return db.users.delete(user_id)

# Agent calls function normally
delete_user_data("user_123")
# Execution pauses, approval request sent to Slack
# Resumes after human approval/rejection

Interrupt pattern (LangGraph):

from langgraph.types import interrupt

def risky_operation(state):
    approval = interrupt({
        "question": "Should I proceed with this operation?",
        "operation": state["message"]
    })
    return {"user_approval": approval}

# Compile with checkpointer for state preservation
app = workflow.compile(checkpointer=MemorySaver())

2. Configure approval channels:

approval_channels:
  high_risk:
    
- slack: "#agent-approvals"
    - sms: "+1234567890"  # For urgent
  medium_risk:
    
- slack: "#agent-review"
  low_risk:
    
- email: "team@company.com"

3. Set context requirements:

  • Why is the operation needed?
  • What data will be affected?
  • Is it reversible?
  • What are the alternatives?

Prerequisites:

  • Integration with communication platforms (Slack, email, SMS)
  • Clear risk classification criteria
  • Fast human response time for time-sensitive operations
  • Fallback strategies when approval is denied

Trade-offs

Pros:

  • Enables safe autonomous execution of risky operations
  • Maintains human oversight where it matters most
  • Lightweight integration (Slack buttons, not complex UIs)
  • Audit trail for compliance and debugging
  • Reduces agent anxiety about mistakes
  • Allows gradual trust expansion over time

Cons:

  • Requires human availability and responsiveness
  • Can bottleneck agent workflows if approvals are slow
  • Infrastructure complexity (notification systems, state management)
  • Risk of approval fatigue leading to rubber-stamping
  • Requires clear classification of what needs approval
  • May interrupt human focus with frequent requests

References