LLMs, GenAI, RAG, agents, evaluation · insight-0634
Require human approval for irreversible actions, showing the exact action rather than the model's summary
- Evidence type
- practitioner heuristic
- Difficulty
- medium
- Roles
- Applied AI, ML engineer
- Industries
- banking, aviation
Summary: situation, action, reason, boundary
Situation
An agent can issue refunds, send emails to customers, cancel bookings or change prices.
Action
Gate irreversible or high-value actions behind an approval screen that renders the structured call itself: tool, parameters, affected records and amounts; execute exactly what was approved.
Reason
OWASP lists human approval of high-impact actions as a mitigation for excessive agency, but it only works if the reviewer sees what will run. A summary is generated text and can be wrong or manipulated.
Boundary
Payments, external communication, deletions, configuration changes.
Symptom or risk
An approval step shows the model's description ("refund the customer"), which can differ from the actual call (a larger amount, another account).
Exceptions
Low-value reversible actions inside limits, which can be automated with audit logs and post-hoc sampling.
Trade-offs
Approvals add latency and reviewer fatigue; set thresholds so humans see the few decisions that matter.
Pitfalls
Approving a plan, then letting the agent change parameters during execution.
Lessons and concepts
Claims and their sources
OWASP's Excessive Agency entry recommends human approval of high-impact actions and enforcing authorisation in downstream systems rather than relying on the LLM.