Choose human approval gate when a running agent or automation is paused at one armed step and an eligible human can approve, reject, edit, cancel, bypass, or let it expire before execution resumes.
Choose human approval gate when a running agent or automation is paused at one armed step and an eligible human can approve, reject, edit, cancel, bypass, or let it expire before execution resumes.
Practice the judgment: Imagine this situation: The agent says it drafted an email but sends it to customers when the user taps Run. Write the person's goal, choose one of these patterns, and show the state that helps the person continue. Use the decision rules and source trail below to explain your choice.
Review the underlying principle →| Dimension | AI agent acts without approval | Human approval gate | Agent plan preview | Agent progress trace | Tool-use visibility | Dangerous-action review |
|---|---|---|---|---|---|---|
| UI or UX | UI + UX - Anti-pattern for agentic side effects executed before human authorization | UI + UX - Runtime checkpoint that pauses AI or automation until an eligible human authorizes the next step | UI + UX - Pre-execution preview of an AI agent's proposed multi-step plan, tools, data access, and expected outputs | UI + UX - Live execution trace for an AI agent or automation run after work has started | UI + UX - Inspectable disclosure of AI agent tool calls, inputs, outputs, permissions, and side effects | UI + UX - Pre-execution review of high-impact actions that may affect money, access, production systems, legal status, customers, external recipients, or safety |
| UI guidance | Before a high-impact agent step can run, show the proposed action, target, payload, tool, approver rule, side effect, risk, expiry, and explicit approve, edit, reject, cancel, or stop controls. | Render a human approval gate as a paused automation checkpoint with the proposed action, tool or workflow step, triggering rule, risk level, payload snapshot, requester or agent, approver eligibility, timeout, and explicit approve, reject, edit, cancel, or bypass controls. | Render agent plan preview as a pre-run plan with objective, ordered steps, planned tools, data sources, permissions, assumptions, dependencies, approval gates, expected outputs, and controls to edit, approve, run, save, or cancel. | Render an agent progress trace as a live, ordered run timeline with run ID, plan version, current step, queued steps, active tool or task, elapsed time, last event time, step status, blocked gates, retry state, and final outcome. | Render tool-use visibility as an inspectable tool-call surface with tool name, purpose, input summary, output summary, permission scope, data source, side-effect risk, status, timestamps, and redaction state. | Render dangerous-action review as a pre-execution checkpoint that names the armed action, actor, target, scope, affected systems, external effects, risk reason, evidence, freshness, permissions, alternatives, and exact outcome of Run, Cancel, Edit, or Escalate. |
| UX guidance | Protect users from surprise agent side effects by separating proposed work from executed work, pausing risky steps, and requiring authorization that is valid only for the displayed payload. | Use human approval gate when automation is ready to act but policy, risk, confidence, cost, access, publication, deployment, customer impact, or legal consequence requires a human decision before execution continues. | Use agent plan preview when users need to understand and shape what an AI agent will do before it starts calling tools, changing records, sending messages, spending budget, or making external side effects. | Use agent progress trace when an AI agent or automation has started multi-step work and users need to monitor progress, intervene on stalls or gates, understand partial completion, and know whether the reviewed plan is still being followed. | Use tool-use visibility when users need to understand, verify, approve, debug, or audit how an AI agent used tools, data, or integrations during a run. | Help users decide whether to run, revise, cancel, defer, or escalate the action by making the action payload inspectable, comparing it with safer alternatives, revalidating stale state, and recording what the reviewer saw before execution. |
| Good UI | A support agent pauses before issuing a refund, shows customer, order, amount, policy source, approver role, and Approve refund, Edit amount, Reject, and Stop run controls. | An AI support agent pauses before issuing a refund, shows the proposed amount, customer, policy match, confidence, source grounding, approver role, timeout, Approve refund, Edit amount, Reject, and Stop run controls. | A sales assistant previews a six-step account-research plan with CRM lookup, web search, draft email, approval gate before send, estimated sources, and editable recipient scope. | An account research agent trace shows Run A-204, reviewed plan P-18, completed CRM lookup, active policy search, queued draft email, approval gate pending before send, elapsed time, and a View tool details control. | A research agent shows Knowledge search, Web search, and CRM lookup tool cards with purpose, input summary, source scope, output summary, status, and redacted raw request details. | A production console shows Restart payment workers, affected region, open incidents, customer impact, rollback owner, evidence links, change window, dry-run result, and Run restart only after the reviewer checks the risk inventory. |
| Bad UI | The plan preview says Draft email, but the agent also sends it to customers when the user taps Run. | A reviewer can approve an automation run after the action already executed, making the gate only decorative audit text. | A list of completed tool events is titled Plan preview, confusing proposed work with already executed work. | A trace displays raw tool JSON and private tokens as the only progress feedback. | The UI dumps raw JSON containing secrets and internal system prompts as the only explanation of tool use. | A warning says This may be risky but hides the target, policy trigger, evidence, and whether the action can be undone. |
| Good UX | A manager sees the agent is armed to change account access, edits the target group, approves the revised payload, and the run resumes only that step. | A billing lead opens the paused refund gate, sees that the amount is under policy but source grounding is partial, edits the refund to the verified amount, approves, and the agent resumes only that step. | A manager removes the Send email step, narrows the data source to approved knowledge, approves the remaining plan, and sees execution start from the revised version. | A user watches the active step move from searching policies to drafting the email, opens the blocked permission item, grants access, and sees the run continue from the same step. | A user opens the active CRM lookup, sees it is read-only, verifies the account ID, and continues watching the run. | A release manager sees that a deploy action affects production EU, has a stale smoke test, cancels execution, refreshes checks, and then runs the action with an audit record. |
| Bad UX | A user asks an agent to research an account and later discovers it changed the opportunity stage. | A human approves a stale agent action from email and the agent applies it to a different customer state. | Users approve a plan that says Research account but the agent also updates the opportunity stage. | A trace restarts from the top after a retry and makes users think earlier completed steps ran twice. | A tool card says Success even though the returned data was partially redacted or stale. | A user approves a notification from email after the underlying payload changed, and the system executes against a different customer. |
| Best fit | An AI agent or automation can create side effects that affect customers, money, access, production systems, legal status, public content, sensitive data, or external recipients. | An AI agent, workflow, deployment, or automation is ready to perform a high-impact step and must pause for human authorization. | An AI agent or automation can show a proposed multi-step plan before execution. | An agent or automation run has started and spans multiple steps, tools, gates, or side effects. | An AI agent or automation calls tools, functions, APIs, retrieval systems, commands, or integrations. | A user, agent, automation, or admin tool is about to execute a high-impact action that can affect money, access, production systems, legal/compliance state, customers, external recipients, sensitive data, or safety. |
| Avoid when | The design already pauses every high-impact side-effect step in a valid human approval gate. | The action has already happened and users only need an audit log. | The work is a simple single recommended action. | The task is a single generated answer stream. | Users only need the high-level run sequence, which belongs to agent progress trace. | The risk is narrowly permanent deletion or loss of a named object; use destructive action confirmation. |
| Required state | Approval required before side effect state. | Paused gate state with proposed action, payload snapshot, reason for gate, and run context. | Draft plan state with objective, ordered steps, planned tools, and expected output. | Run started state tied to run ID, plan version, objective, and user who started the run. | Pending tool call state with tool name, purpose, requested permission, and side-effect risk. | Armed action state with verb, target, payload, actor, source, and exact execution boundary. |
| Accessibility burden | Expose whether a step is proposed, armed for approval, running, completed, rejected, cancelled, bypassed, or rolled back as text. | Expose gate status, proposed action, target, payload summary, risk, approver rule, timeout, and current run state as text. | Expose objective, plan version, step order, step status, tool, data access, side effect, and expected output as text. | Expose trace status, run ID, current step, elapsed time, blocked state, final outcome, and details availability as text. | Expose tool name, status, permission, risk, input summary, output summary, and redaction reason as text. | Use headings and labels that name the action and target before risk details. |
| Common misuse | Treating Run agent as permission to execute every hidden side-effect step. | Using a post-action audit record as if it were a pre-action human gate. | Showing a vague plan summary while hiding planned tool calls, data access, and side effects. | Using one spinner or vague Thinking label for a multi-step agent run. | Dumping raw JSON, stack traces, tokens, secrets, or hidden prompts as the user-facing tool view. | Showing a risk warning but hiding the action payload, target, recipients, amount, command, environment, or external effect. |