“Human in the loop” is not a complete requirement. An approval gate only helps when the reviewer understands the proposed action and can stop it before it happens.
Identify the consequential actions
Map where a workflow sends a message, changes a record, shares information or commits money. Decide which actions can proceed under existing rules and which need explicit approval. Keep the system's permissions narrower than the employee's general account access.
For example, an assistant can prepare a supplier comparison without also receiving permission to issue a purchase order. Treat these as separate capabilities in the scope.
Make review meaningful
Show the reviewer the proposed action, relevant evidence, destination and likely effect. A vague “Approve?” button invites mistakes. Where the action has changed since review, require a fresh decision rather than reusing an earlier approval.
Define what happens if nobody responds. Suitable choices might include waiting, escalation or cancellation; automatic approval should never be an accidental timeout behaviour.
Test the gate, not just the happy path
- Try an expired approval and a reviewer without the necessary permission.
- Change the proposed content after approval and confirm it is not silently sent.
- Retry the same request and check that it does not execute twice.
- Confirm the operator can cancel outstanding requests.
Keep an audit record containing who approved what and when, with appropriate access and retention. Do not put passwords or private message contents into unrestricted logs.
OWASP's LLM application guidance is a useful reference when assessing tool permissions and excessive agency. Ask an AI automation specialist to demonstrate the approval boundary before accepting the integration.