# Approval workflows for AI agents: human in the loop

> How to design approval workflows for AI agents: why writes wait for a human, what to gate, and how to set rules, with StellarFirm Approve as the example.

By StellarFirm team. Published 2026-10-24. 5 min read.

Keywords: human in the loop, ai agent approval, approval workflow, ai agent safety, house rules, auto approve
Tools covered: StellarFirm, Claude Code, OpenAI Codex

## Key takeaways

- An approval workflow lets an AI agent prepare work and makes a person decide before anything irreversible or visible to others happens.
- Gate by consequence: reading is free, and sending, deploying, charging, publishing, and deleting wait for a human.
- Write standing rules, review the actual change before approving, and widen autonomy in small steps as trust grows.
- In StellarFirm every risky step waits for Approve unless your house rules allow it, and spending your money always asks.

An approval workflow for an AI agent is a rule that the agent prepares and a person decides before anything that cannot be undone, or that other people can see, actually happens. Done well, it keeps the speed of automation and removes the fear. This guide explains the principle, what to gate, how to write rules, and how StellarFirm's Approve puts it into practice.

## Why should writes wait for a human?

Agents are good at preparation and sometimes wrong in confident ways, so the cheapest safeguard is a person at the point of consequence. A wrong draft costs nothing. A wrong email, deployment, or charge may cost a great deal.

The design principle is simple: let the agent do everything up to the moment of effect, then stop. The person sees what will happen and says yes or no. This also works well with the way agents are built: tools that read are low risk, and tools that write are where the gate belongs. Major coding tools follow the same idea. Claude Code and OpenAI Codex each let you decide what the agent may do without asking, and the MCP specification stresses user consent for tool use.

## What should I gate?

Gate by consequence, not by tool name. Ask two questions about any step: can it be undone, and can anyone outside see it?

| Step | Gate? | Why |
| --- | --- | --- |
| Reading, searching, listing | No | Nothing changes |
| Drafts that are not sent | No | Nothing leaves |
| Editing files in the agent's own workspace | No | Easy to inspect and discard |
| Opening a pull request, pushing a branch | Yes | Other people see it |
| Sending mail, creating events | Yes | It reaches other people |
| Deploying | Yes | It changes what users get |
| Charging or spending money | Yes, always | It is hard to reverse |
| Deleting or closing in a connected service | Yes | Often permanent |

StellarFirm follows this table. Reading, reviewing a pull request, checking CI, drafts, and the Coder editing files in its own workspace do not ask. Opening a pull request, pushing, opening an issue, sending mail, creating a calendar event, charging a customer, registering a domain, changing DNS, and deploying all wait. See [Approvals](/docs/ceo/approvals) for the complete list.

## How does Approve work in StellarFirm?

A risky step is held, the job stays open, and you answer Approve or Reject. Approve carries out that one step and gives no blanket permission for the next. Reject cancels it, and nothing is sent, pushed, or created.

1. The assistant works and reaches a step that affects the outside world.
2. The request shows what it wants to do and where.
3. You answer in the chat, or on the Approvals screen, which lists everything waiting across all chats.
4. The assistant carries on and reports back.

You do not have to answer right away. For a pull request you can open the job in Jobs and read the Coder's actual changes first. Spending your money always asks, with no switch to turn that off, and the request says what it will pay.

```prompt title="See what is waiting"
CEO, list everything waiting for my approval, with one line on what each step will do and which assistant asked.
```

```prompt title="Explain a request before I decide"
CEO, explain the approval request for [job] in plain words: what happens if I approve it, what happens if I reject it, and what I should check first.
```

## How do I set rules?

Write standing rules once so you decide less often and better. StellarFirm gives you three layers.

| Layer | What it does |
| --- | --- |
| Approval rules | Standing instructions: "ask me first" or "never allow" for a kind of step. You start with one default: never post on social media. |
| House rules | The rules in your company brief plus what you allow without asking. They decide what happens after the work. |
| Auto-approve | Switches for production actions and deletions. Every one starts off and only you can turn it on. |

Steps that reach other people, such as pull requests, issues, mail, events, and charges, always ask today, and no switch lifts a rule. StellarFirm also learns from your choices: if you keep rejecting one kind of step it suggests a never rule, and it never changes a rule on its own. See [house rules](/docs/ceo/house-rules).

Good rules are short and checkable:

- Open every pull request for review, and ship nothing without my approval.
- Never let any assistant ship to production.
- Ask before the Coder runs a command on its computer.

```prompt title="Set a standing rule"
CEO, I never want [assistant] to [kind of step] without asking me first. Which approval rule should I add, and what will change about how it works?
```

```prompt title="Write house rules"
CEO, help me write house rules for my company. Ask me up to five questions about pull requests, sending, and releases, then draft the rules as a short list.
```

## When is auto-approve a good idea?

Turn on auto-approve only for a kind of step you would be comfortable hearing about afterwards. With a category on, the assistant does that step without asking and tells you in the same chat. You can turn it off at any time, and it applies immediately. StellarFirm asks you to confirm and warns that the assistant may do something unexpected.

A sensible path to trust:

1. Start with everything behind Approve.
2. Read the diffs and requests for a couple of weeks.
3. Notice which kinds of step you always approve unchanged.
4. Loosen only those, one at a time.

## What about routines and loops?

Scheduled work never skips an approval. A routine or loop that sends, publishes, creates, or spends waits for you on every run, exactly as if you had typed the message, and a loop does not start its next run while the last one waits. See [routines and loops](/docs/ceo/routines-and-loops).

## What are common mistakes?

| Mistake | Better |
| --- | --- |
| Approving without reading | Open the job and read the change first |
| One blanket rule for everything | Rules per kind of step |
| Gating reads too | Let reading run, so approvals stay meaningful |
| Putting tokens or passwords in chat | Connect services through Integrations |
| Widening autonomy fast | Widen one category at a time |

Too many approvals teach people to click yes without looking, so gate what matters and leave the rest. If you want the wider picture, read [what is an AI agent assistant](/blog/what-is-an-ai-agent-assistant) and [your first week with the Coder](/blog/stellarfirm-coder-first-week).

## Frequently asked questions

### What is human in the loop for AI agents?

It means a person reviews and decides at the points where an agent's action matters, instead of letting the agent run everything alone. The agent does the preparation, and the human makes the call.

### Which agent actions should need approval?

Actions that are hard to undo or visible to other people: sending messages, opening pull requests, deploying, charging, publishing, deleting, and spending money. Reading, searching, and drafting can usually run without asking.

### What is auto-approve and is it safe?

Auto-approve lets an agent do one kind of step without asking and tell you afterwards. It is only as safe as the category you choose, so enable it narrowly, for steps you would be comfortable hearing about later.

### How does Approve work in StellarFirm?

A risky step is held and the job stays open. You answer Approve to carry out that one step, or Reject to cancel it, on the Approvals screen or in the chat.

## Sources

- [Claude Code documentation: Settings and permissions](https://code.claude.com/docs/en/settings)
- [OpenAI Codex documentation](https://developers.openai.com/codex)
- [Model Context Protocol: Specification](https://modelcontextprotocol.io/specification)

---

Source: https://stellarfirm.ai/blog/approval-workflows-for-ai-agents