Back to Patterns

Approval-Gated Actions

Agent Patterns

Summary

Approval-gated actions is a safety pattern that pauses agent execution before sensitive operations and requires explicit human or policy-based approval to proceed. The agent classifies each action, requests approval for high-risk operations, and only continues when approval is granted.

How it works

  1. Action classification -- each tool call is classified as auto, manual, or blocked based on a predefined policy.
  2. Approval request -- for manual actions, the agent presents a summary of the intended action and waits for approval.
  3. Pause and resume -- execution pauses at the gate and resumes only upon approval signal.

Action categories

  • Auto: Non-sensitive actions that execute without approval (read queries, simple lookups).
  • Manual: Actions that require approval before execution (writes, deletes, external API calls).
  • Blocked: Actions that are never allowed regardless of context.

Escalation

If an approval request times out, the agent either retries with a simpler request or falls back to a safe default. Urgent operations may include a bypass mechanism that logs the action for audit.

Build This Pattern

Copy this prompt and paste it into Claude Code, OpenCode, Codex, or Cursor to implement this pattern.

Build an approval-gated action system for safe side effects. ROLE: You are a safety system that controls when AI models can execute actions with side effects, requiring human or policy approval before execution. CONSTRAINTS: - Three action categories: auto-approve (no side effects), require human approval (data changes), always blocked (destructive) - Approval requests must expire after 24 hours; expired requests are automatically rejected - Urgent bypass available with audit logging; bypass requires explicit justification - Cascading approvals: approve once for a batch of related actions - All approvals must be logged with who approved, what was approved, and when TOOL CALLING: - Use function calling for: request_approval(action_type, action_data, urgency?), approve_request(request_id, approver_id, notes?), reject_request(request_id, reason?), get_pending_approvals(approver_id?), get_approval_stats(date_range?) - Each tool returns structured JSON with approval data and metadata STRUCTURED OUTPUT: - Approval request must return JSON: { request_id: string, action_type: string, action_data: Record<string, any>, requester: string, status: 'pending' | 'approved' | 'rejected' | 'expired', created_at: string, expires_at: string, urgency: 'normal' | 'urgent' } - Approval decision must return JSON: { request_id: string, decision: 'approved' | 'rejected', approver_id: string, notes: string, decided_at: string, execution_allowed: boolean } - Approval stats must return JSON: { total_requests: number, approved: number, rejected: number, expired: number, avg_approval_time_minutes: number, by_action_type: Record<string, number> } CHAIN OF THOUGHT: - Request: receive action → classify category → check if auto-approve → create request if needed - Approval: notify approver → wait for decision → validate approver权限 → record decision - Execution: if approved → execute action → log result → return to requester - Handling: if rejected → inform requester → suggest alternatives → log rejection reason FEW-SHOT EXAMPLES: Request: { request_id: 'apr_123', action_type: 'send_email', action_data: { to: 'customer@example.com', subject: 'Your order is ready' }, requester: 'crm-agent', status: 'pending', urgency: 'normal' } Approval: { request_id: 'apr_123', decision: 'approved', approver_id: 'reviewer_1', notes: 'Looks good, send it', decided_at: '2025-01-15T14:30:00Z', execution_allowed: true } Stats: { total_requests: 87, approved: 72, rejected: 8, expired: 7, avg_approval_time_minutes: 45 } EVALUATION CRITERIA:- Approval accuracy: percentage of approval decisions that are appropriate - Response time: average time from request to approval/rejection - Compliance: percentage of actions that follow the approval workflow - Audit completeness: percentage of approvals with complete logging The system should: 1) Define action categories: auto-approve, require human approval, always blocked, 2) When model requests gated action, pause execution, create approval request, resume only when approved, 3) Handle approval timeouts, expired approval requests, 4) Handle cascading approvals (approve once for batch), 5) Support urgent bypass (override with audit), 6) Always log who approved, what was approved, and when, 7) Verify gated actions are correctly blocked without approval.