Mortanas AcademyHow should human approval gates for AI actions be designed?
Place human approval before actions that are external, irreversible, high-value, rights-affecting or difficult to detect after execution. The reviewer must see the proposed action, evidence, uncertainty, affected target and relevant policy—not just a generic confirm button. Use role-based authority, separation of duties for the highest risks, time limits and a safe default when approval is absent. Log proposal, reviewer, decision, edits and execution result, then test whether reviewers actually catch seeded errors.
A practical five-step workflow
- Classify actions by impact, reversibility, value and external reach.
- Define which roles may approve each action class.
- Present evidence, uncertainty, policy and a clear action preview.
- Use expiry, rejection, edit and safe-failure behaviour.
- Audit decisions and test reviewer effectiveness with known error cases.
Worked example
An AI agent may draft a supplier email and purchase request, but a budget owner sees the vendor, amount, evidence and policy before any order is placed.
Risk controls
- Approval fatigue from too many low-value prompts
- A confirm button without evidence or context
- Allowing the requester to approve their own highest-risk action
Primary and authoritative sources
Use the current version of each primary source for critical, legal or regulated decisions.
- NIST AI Risk Management Frameworkwww.nist.gov
- European Commission AI Act overviewdigital-strategy.ec.europa.eu
Continue with the detailed Mortanas guide
This answer brief gives the decision pattern. The linked implementation guide expands the workflow, measures, failure modes and operating notes.
Questions about this answer
How should human approval gates for AI actions be designed?
Place human approval before actions that are external, irreversible, high-value, rights-affecting or difficult to detect after execution. The reviewer must see the proposed action, evidence, uncertainty, affected target and relevant policy—not just a generic confirm button. Use role-based authority, separation of duties for the highest risks, time limits and a safe default when approval is absent. Log proposal, reviewer, decision, edits and execution result, then test whether reviewers actually catch seeded errors.
What should be measured?
High-impact actions executed with valid approval, plus seeded-error detection and approval-override rates.
What evidence should be retained?
Keep the approved purpose, input or source references, relevant system and prompt version, human reviewer, corrections and the final outcome. Retention must follow the organisation’s privacy, security and records rules.
When should a human intervene?
Human review should increase when the output can affect rights, safety, money, reputation, access or an irreversible external action, or when evidence is missing, conflicting or uncertain.
Scope: Educational guidance, not legal, medical, financial or security advice. Verify current primary rules and obtain qualified advice for regulated decisions.