Approval gates for AI agents: what needs a human OK, and how to make it fast

An approval gate is a point where an AI agent stops, shows you exactly what it is about to do, and waits for a yes. Done well, it is the difference between an agent you can trust with your customers and one you have to watch. Done badly, it becomes a stream of pings you approve without reading, which is worse than having no gate at all.

Our rule for small businesses is simple: gate four kinds of action — messages that leave the business, money that moves, content that gets published, and data that gets deleted. Everything else can start as draft-only and graduate to act-and-report once the agent has a clean record. That graduation path is set out in our guide to delegating work to AI agents; this article is about the gates themselves.

Which agent actions need a human approval

The test is not “is this important?” but “can this be undone before anyone outside the business notices?” An internal note filed in the wrong folder is a nuisance. An SMS sent to the wrong tenant is a privacy incident and an awkward phone call.

Notice what is missing: research, analysis and drafting. Those need review, not approval. You read a prospect list or a reconciliation report and act on it; the agent didn’t do anything to the outside world by producing it.

Human-in-the-loop AI approvals that take seconds

An approval request should be answerable from your phone, in a queue at the bakery, without opening another app. If you have to log in somewhere to check context, the request is badly designed. Every request needs five things:

1. The action in one line: “Send this reminder to Sam Lee at Harbour Physio.”
2. The exact content, as it will be sent — not a summary of it.
3. The evidence: why the agent thinks this is right, for example “invoice INV-2231, A$880, 21 days overdue, no reply to the 10 October reminder”.
4. Anything unusual, flagged at the top: a first contact, a large amount, a rule the agent wasn’t sure about.
5. A clear way to respond: approve, edit, or skip — and what happens if you don’t answer.

Compare that with “Approve 7 reminders?” and a link. The second version invites rubber-stamping because it hides the content. If an agent sends you batch requests, ask for the batch to be listed in full with the unusual ones first.

Single approvals versus batches

Batch approvals are fine for homogeneous work — ten identical appointment reminders — as long as every item is visible and you can pull one out. Never batch mixed work. A refund and a marketing email in the same approval is how the refund gets missed.

Drafts are not decisions

A useful mental model: the agent produces drafts, you make decisions. A draft can be wrong at no cost. A decision commits the business. Keeping those two clearly separate in your workflow is what makes it safe to let the agent draft aggressively — fifty follow-ups, a full proposal, a rewrite of the website copy — because nothing becomes real without you.

That separation also helps your team. When a staff member sees “draft” in the thread, they know it is not yet the company’s position. When they see “sent, approved by Elena at 2:14pm”, they know it is. Your agent’s log should make that distinction obvious, which is the subject of our security article on audit trails for AI agent actions.

Undo windows: a safety net, not a substitute

An undo window holds an approved message for a short period before it is actually sent, so a slip of the thumb can be reversed. Fourth Woman Therapy, for example, uses a 60-second email undo window on top of explicit approval. It is a good idea and you should have one for email.

But be clear about what it covers. An undo window catches the “oh no, wrong client” moment straight after you tap approve. It does not catch a message whose content was wrong all along, and it does nothing once a message has been delivered. SMS in particular is effectively instant. So the approval step is where you check content; the undo window is for slips.

Avoiding approval fatigue

Approval fatigue is the main way gated systems fail. You start reading every word, by week three you approve on sight, and the gate has become theatre. Watch for these signs and act on them:

• You approve the same kind of item unchanged, every time. If it isn’t outward-facing, promote that task to act-and-report. If it is, ask for a weekly sample review instead of a per-item one only if the risk is genuinely low — most customer messaging should stay gated.
• Requests arrive one at a time all day. Ask the agent to queue non-urgent approvals into two or three windows a day, and keep real-time pings for time-sensitive work.
• You keep making the same edit. That is a rule, not a review. Tell the agent the rule and check it appears in its written instructions — see how to write instructions for AI agents.
• Requests need context you have to go and find. Fix the request format, not your patience.

Items that are stuck — you didn’t answer, or the agent couldn’t prepare them — shouldn’t vanish. They belong in the daily list of exceptions, which we design in the daily exception report.

When the approver shouldn’t always be you

For a sole operator, approvals coming to your phone is the feature. For a growing team, it becomes a bottleneck when you are on leave, in surgery, on a roof or asleep. Decide who else can approve what, and write it down: the office manager approves tenant reminders, only the principal approves anything involving trust money, and so on.

Cortex also offers real people as an add-on. The human-in-the-loop packs are 10 hours for A$990 (A$99 an hour) or 20 hours for A$1,760 (A$88 an hour), with extra hours at A$109, all plus GST. Typical uses are covering approvals and follow-through while the owner is away, or handling the parts of a workflow that genuinely need a person. Details are on the pricing page.

Outgoing messages carry obligations in Australia

The approval step is also where you catch compliance problems. Under the Spam Act 2003, commercial electronic messages — the ACMA lists email, SMS, MMS and instant messages — generally need consent, must identify the sender and must include a working way to unsubscribe. See the ACMA’s guidance on avoiding sending spam. An agent can be told those rules, but the business sending the message remains responsible.

Treat this as general information, not legal advice. Practically, it means your approval request for a promotional message should show the consent basis (“opted in via website form, 3 August”) and confirm the unsubscribe line is present. Calls have their own rules, which our voice series covers in ACMA rules for AI outbound calls.

If you want to see how approvals arrive in the chat thread alongside the work they relate to, the Sessions page shows the flow end to end.