Human approval is the most cited control in AI governance and the worst implemented. The typical failure is not its absence — it is excess: asking for confirmation on everything, which produces fatigue, reflex clicking and a well-documented illusion of oversight.
The criterion for making the list
An action requires a human when it passes two tests at once: it is hard to undo and it affects someone beyond the agent. That narrows the universe to four verbs:
- Delete — data, records, resources, branches.
- Transfer — money, ownership, or data outside the perimeter.
- Publish — anything that becomes externally visible.
- Grant — permission, access, invitations. This is the verb that creates the other three later.
Reading does not qualify. Writing to a draft does not qualify. Creating a disposable resource does not qualify. If the list has twenty items, it will not be respected.
How the approval must be presented
Here lives the detail that invalidates most implementations. The screen must show what will be executed, not what the model says it will execute. Those differ when the displayed text diverges from the read text — researchers demonstrated payload concealment in tool metadata using invisible Unicode blocks, creating exactly that gap.
- Show the literal argument, normalised, with invisible characters revealed.
- Show the resolved destination resource, not the alias.
- Do not allow batch approval across different verbs.
- Make approvals expire — a request pending for hours becomes a distracted click.
If the operator cannot explain what they approved thirty seconds later, the control does not exist.
How to tell whether it works
One metric: rejection rate. If nobody ever rejects anything, either the agent is perfect or approval became a rubber stamp. In practice it is always the second. A near-zero rejection rate over months is a signal to shorten the list or improve the presentation — not to celebrate.
