AI agents
Human in the loop: when a person approves what an AI agent does
Human in the loop means a person approves an AI agent's high-impact actions before they happen. Everything else runs on its own with minimal tools and permissions, and authorization lives in the downstream systems, outside the model's judgment. That is how OWASP recommends keeping an agent with too much power in check.
Updated
What does human in the loop mean for AI agents?
The agent works on its own but pauses at set points and waits for a person. Anthropic describes agents that stop for human feedback at checkpoints or when they hit a blocker, with stopping conditions set in advance, such as a maximum number of iterations.
Which actions need human approval?
High-impact actions, the ones that are hard to undo. OWASP's example is an assistant that reads email to summarize it: it may draft a reply, but a person reviews and sends every email it writes.
Why not let the model decide what is allowed?
Because the model can be tricked. In the same OWASP example, a crafted email carries hidden instructions telling the agent to scan the inbox and forward sensitive data to an attacker. OWASP's answer is to put authorization in the downstream systems. Claude Code follows the same logic: permission rules are enforced by Claude Code, and nothing in the prompt changes what they allow.
What are good AI agent guardrails?
- Give the agent only the tools its job needs.
- Keep each tool narrow: a mail summarizer only reads mail.
- Grant minimal permissions on other systems, for example a read-only scope.
- Test in a sandbox first, with the guardrails already in place.
Frequently asked questions
What does EU AI Act Art. 14 require?
It covers high-risk AI systems, not every agent, and it does not apply yet: the deadlines for each category are on the article's page. It requires the system to let the people overseeing it understand its limits, disregard or reverse an output, and stop it, for example with a "stop" button.
What is automation bias?
The tendency to rely automatically, or too much, on what a system produces. Art. 14 asks that a high-risk system helps the person overseeing it stay aware of it.
What is excessive agency?
A risk on the OWASP list for LLM applications: an agent can take damaging actions because it has too much functionality, too many permissions or too much autonomy.
Isn't a good prompt enough?
No. Prompt instructions shape what the model tries to do. What it is allowed to do is decided by rules enforced outside it, such as the permission rules in Claude Code.
Doesn't human approval slow the agent down?
Only on high-impact actions. Everything else runs on its own, within the tools and permissions the agent was given.
Sources
Further reading
Related articles
Claude Code hooks: how to stop an action before it runs
A Claude Code hook is a handler that runs automatically at a fixed point in a session, such as a command, an HTTP call or a prompt. The PreToolUse hook runs before Claude uses a tool and can stop the call with exit code 2 or a deny decision, and the reason goes back to Claude.ReadAI answers with citations: grounding an LLM in your sources
An answer with citations puts the passage that supports each claim right next to it. The model is allowed to say "I don't know", pulls the quotes first and answers second, and any claim without a quote is retracted. Hallucinations drop a lot but do not disappear, so a person checks the decisions that matter.Read
Case studies
Related services
Want an agent that asks before the actions that matter?
We build agents that handle routine work on their own and wait for a person's yes on high-impact actions.
See AI agents