AI agent human approval: what my agents can't do without me

Part of my team is AI agents now. They write code, draft copy, plan social posts and research keywords while I'm busy with other work. They're fast, and they do exactly what they're told, which is the part that worries founders. So the first thing I designed was the human approval step for every AI agent, the point where a person says yes before anything real happens. Getting that step right decided whether I could trust them with real work.

How human approval works in my AI office

I built my agents an office, an animated building where each one has a desk and a chat. Alfred is my chief of staff. Lucius builds websites, Maria writes copy, Barry handles SEO, and there are a few more for sales, social and finance. It runs on Next.js 16 and Supabase, with Claude Code doing the thinking. The rule that shapes everything else is simple. An agent never starts work from a chat message.

When I ask Lucius for a change to a site, he doesn't touch the code. He replies with a plan. The plan becomes an approval card on my dashboard. Nothing runs until I approve it. Not even a small fix. Once I do, a small runner on my own PC picks the plan up. It sends a heartbeat every 15 seconds, so the building shows Open or Closed and I know whether anyone is at their desk. Then the agent does the work with edit tools, inside its own folder only.

That loop of plan, approve and run is slower than letting an agent loose. It's also the reason I let them near client work at all. I read the plan, I can see what it's about to touch, and I catch the misunderstanding before it costs anything instead of after.

The actions that always need me

Some actions are denied to the agents outright. Deleting, pushing code, deploying, sending messages and spending money. If an agent tries one of those, it doesn't fail quietly and it doesn't go ahead. The request turns into an approval card and waits for me.

I picked those actions because they're the ones you can't take back, or the ones that leave the building. A wrong draft in a folder costs me a minute. I delete it. A wrong email to a client, or a deploy that breaks a live site, costs a lot more than that, and an apology doesn't undo it.

This article is an example. Barry researched what people search for on the topic and checked the sources, and Maria proofread it. They can prepare a post and save it as a draft in GitHub, but neither of them can publish it. I read it and publish it myself.

What runs without asking

There's a catch. If everything needs approval, you end up approving everything without reading it. Then the step stops protecting you.

So the safe work runs freely. When I chat with an agent, its replies go through Claude Code with read-only tools. It can look at files, answer questions and suggest a plan, but it can't change anything. Approved plans get edit tools, and only inside that agent's own folder, so a copywriting task can't wander into the website code.

The runner also handles the dull parts on its own. It passes work between agents, recovers messages that went unanswered after a crash, and pauses itself when it hits a usage limit. None of that needs me, and none of it can do damage.

Where to put AI agent human approval in your business

You don't need to build an office to use the same idea. Before you hand any task to an agent, whether it's a chatbot, an automation in GoHighLevel, Make or n8n, or a coding agent, sort what it might do into two piles.

The first pile is things you can undo or that stay inside the business. Drafting a reply, tagging a lead, summarising a call, filling a spreadsheet. Let the agent do those and check the results afterwards.

The second pile is things you can't undo or that a customer will see. Sending the reply, refunding an order, changing a price, deleting a record, publishing a page. Those wait for a person. Every time.

Then decide who that person is. On a small team it's usually the owner, and that's fine to begin with. What matters is that every request lands in one queue where someone will actually look, instead of being buried in an inbox or a Slack channel nobody opens.

When I draw a system before building it, which I wrote about here, each AI step gets the same questions as any other box. What goes in, what comes out, what it's allowed to touch, and who checks its work. The approval point is one more box on that page, with an arrow to a real person.

The approval step has to be easy to read

An approval only helps if the person approving can spot a mistake. If the plan is three pages of jargon, people stop reading it and click yes, and then the check exists on paper only.

I keep my approval cards short. What the agent will do, which files or accounts it will touch, and what done looks like. If I can't follow a plan in about a minute, it goes back. That's the same habit I use with human teams, and it's why handoffs between agents worry me as much as handoffs between people. I covered that in most projects break at the handoff.

The bigger AI labs say much the same thing. Anthropic's guide to building effective agents recommends starting simple and adding checkpoints where agents pause for human feedback. The NIST AI Risk Management Framework also treats human oversight as part of managing AI risk. You don't need to read either cover to cover to run a small business, but it's good to know the instinct to keep a person in the loop is shared by people who think about this full time.

Start with more approval and loosen it later

When you first put an agent to work, ask it to get approval for more than feels necessary. Watch what it proposes for a few weeks. The tasks where you approve every plan without changes are the ones you can move to the first pile. The tasks where you keep correcting it stay where they are.

The deny list is the part I'd never loosen. Delete, push, deploy, send and spend stay with a person, however good the agent gets.

If you're thinking about bringing AI agents into your business and want help deciding where the approval points go, get in touch.