Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Human approval before irreversible actions
Verify that the agent runtime blocks execution of privileged or irreversible actions until explicit human approval is received and verified.
OWASP AISVS v1.01, requirement 9.2.1
In plain English
Before an agent does anything privileged or irreversible, such as paying, deleting or sending something outside the organisation, the runtime must hold the action until a person approves it. The system must also check that the approval is real and comes from someone entitled to give it.
What good looks like
- Privileged and irreversible actions are listed, per tool.
- The runtime blocks those actions until approval arrives. The model has no way to skip the step.
- The approver is authenticated and authorised for that kind of action.
- Approval arrives through a channel the agent and its inputs cannot write to.
How teams usually do it
- An approval gate in the tool gateway: the call is parked, a request goes to the approver, and only a verified approval releases it.
- Approval through a separate, trusted interface such as an authenticated web page, a signed chat action or a ticketing workflow.
- Most agent frameworks now have "human in the loop" interrupt features. Use them for the pause, and enforce the rule in the gateway.
Suggested evidence
- The action list and gateway configuration.
- Logs of approved, denied and blocked actions, with approver identity.
- A test showing the action cannot run without approval.
Common mistakes
- Telling the agent in its prompt to ask for approval, which it can skip or be talked out of.
- Accepting "approved" typed into the same chat an attacker may control.
- So many approval prompts that people click yes without reading.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.