Google Analytics, Vercel Web Analytics, Leadsy and the TikTok Pixel stay off until you accept. The help chat starts once you have chosen. The scheduling button starts once you have chosen. Read our Privacy Policy.
Approval workflows for AI agents: human in the loop
How to design approval workflows for AI agents: why writes wait for a human, what to gate, and how to set rules, with StellarFirm Approve as the example.
An approval workflow for an AI agent is a rule that the agent prepares and a person decides before anything that cannot be undone, or that other people can see, actually happens. Done well, it keeps the speed of automation and removes the fear. This guide explains the principle, what to gate, how to write rules, and how StellarFirm's Approve puts it into practice.
Agents are good at preparation and sometimes wrong in confident ways, so the cheapest safeguard is a person at the point of consequence. A wrong draft costs nothing. A wrong email, deployment, or charge may cost a great deal.
The design principle is simple: let the agent do everything up to the moment of effect, then stop. The person sees what will happen and says yes or no. This also works well with the way agents are built: tools that read are low risk, and tools that write are where the gate belongs. Major coding tools follow the same idea. Claude Code and OpenAI Codex each let you decide what the agent may do without asking, and the MCP specification stresses user consent for tool use.
Gate by consequence, not by tool name. Ask two questions about any step: can it be undone, and can anyone outside see it?
Step
Gate?
Why
Reading, searching, listing
No
Nothing changes
Drafts that are not sent
No
Nothing leaves
Editing files in the agent's own workspace
No
Easy to inspect and discard
Opening a pull request, pushing a branch
Yes
Other people see it
Sending mail, creating events
Yes
It reaches other people
Deploying
Yes
It changes what users get
Charging or spending money
Yes, always
It is hard to reverse
Deleting or closing in a connected service
Yes
Often permanent
StellarFirm follows this table. Reading, reviewing a pull request, checking CI, drafts, and the Coder editing files in its own workspace do not ask. Opening a pull request, pushing, opening an issue, sending mail, creating a calendar event, charging a customer, registering a domain, changing DNS, and deploying all wait. See Approvals for the complete list.
A risky step is held, the job stays open, and you answer Approve or Reject. Approve carries out that one step and gives no blanket permission for the next. Reject cancels it, and nothing is sent, pushed, or created.
The assistant works and reaches a step that affects the outside world.
The request shows what it wants to do and where.
You answer in the chat, or on the Approvals screen, which lists everything waiting across all chats.
The assistant carries on and reports back.
You do not have to answer right away. For a pull request you can open the job in Jobs and read the Coder's actual changes first. Spending your money always asks, with no switch to turn that off, and the request says what it will pay.
PromptSee what is waiting
CEO, list everything waiting for my approval, with one line on what each step will do and which assistant asked.
PromptExplain a request before I decide
CEO, explain the approval request for [job] in plain words: what happens if I approve it, what happens if I reject it, and what I should check first.
Write standing rules once so you decide less often and better. StellarFirm gives you three layers.
Layer
What it does
Approval rules
Standing instructions: "ask me first" or "never allow" for a kind of step. You start with one default: never post on social media.
House rules
The rules in your company brief plus what you allow without asking. They decide what happens after the work.
Auto-approve
Switches for production actions and deletions. Every one starts off and only you can turn it on.
Steps that reach other people, such as pull requests, issues, mail, events, and charges, always ask today, and no switch lifts a rule. StellarFirm also learns from your choices: if you keep rejecting one kind of step it suggests a never rule, and it never changes a rule on its own. See house rules.
Good rules are short and checkable:
Open every pull request for review, and ship nothing without my approval.
Never let any assistant ship to production.
Ask before the Coder runs a command on its computer.
PromptSet a standing rule
CEO, I never want [assistant] to [kind of step] without asking me first. Which approval rule should I add, and what will change about how it works?
PromptWrite house rules
CEO, help me write house rules for my company. Ask me up to five questions about pull requests, sending, and releases, then draft the rules as a short list.
Turn on auto-approve only for a kind of step you would be comfortable hearing about afterwards. With a category on, the assistant does that step without asking and tells you in the same chat. You can turn it off at any time, and it applies immediately. StellarFirm asks you to confirm and warns that the assistant may do something unexpected.
A sensible path to trust:
Start with everything behind Approve.
Read the diffs and requests for a couple of weeks.
Notice which kinds of step you always approve unchanged.
Scheduled work never skips an approval. A routine or loop that sends, publishes, creates, or spends waits for you on every run, exactly as if you had typed the message, and a loop does not start its next run while the last one waits. See routines and loops.
It means a person reviews and decides at the points where an agent's action matters, instead of letting the agent run everything alone. The agent does the preparation, and the human makes the call.
Which agent actions should need approval?
Actions that are hard to undo or visible to other people: sending messages, opening pull requests, deploying, charging, publishing, deleting, and spending money. Reading, searching, and drafting can usually run without asking.
What is auto-approve and is it safe?
Auto-approve lets an agent do one kind of step without asking and tell you afterwards. It is only as safe as the category you choose, so enable it narrowly, for steps you would be comfortable hearing about later.
How does Approve work in StellarFirm?
A risky step is held and the job stays open. You answer Approve to carry out that one step, or Reject to cancel it, on the Approvals screen or in the chat.
How to write AGENTS.md for your codebase and llms.txt for your website so AI agents and answer engines can read them. StellarFirm is the worked example.