No. If the same agent can request an action and approve it, you have no control, only a log entry. Approval must come from a human or from a policy engine that runs outside the model and that the agent cannot modify, reconfigure or talk its way past.
What counts as self approval
Self approval is not always obvious. It includes an agent clicking its own confirmation dialog, a second agent built on the same model reviewing the first one's plan, and an agent editing the config that decides what needs approval. All three put the decision inside something an attacker can influence with text.
A subtler version is a human who approves everything the agent proposes within seconds. The click happens, but nobody weighed anything.
Why the model cannot be the gatekeeper
A model decides what to do from its instructions and the content it reads, and that content can include attacker text. If a prompt injection can persuade the agent to take an action, it can often persuade the same agent to say that action is fine.
OWASP's guidance on excessive agency says to implement authorization in downstream systems rather than relying on an LLM to decide whether an action is allowed, and to apply complete mediation so every request is validated against policy. It also says to use human in the loop approval for high impact actions, implemented either in a downstream system or inside the extension that performs the operation.
The MCP specification sets a similar expectation for tools. It says there should always be a human in the loop with the ability to deny tool invocations, and that applications should show which tools are exposed to the model and show confirmation prompts for operations.
Where to place the approval
| Placement | Can the agent bypass it? | Notes |
|---|---|---|
| In the prompt ("ask before deleting") | Yes | Advisory only |
| In the agent's own code path | Possibly | Depends on who can edit it |
| In the tool or downstream service | Hard | Preferred |
| In a separate policy engine | Hard | Preferred, with logging |
Steps to remove self approval
- List every approval point and note who or what can change it.
- Move enforcement into the tool server or the system the tool calls, so the check runs whether or not the model asks.
- Remove the agent's write access to its own policy, role and approval settings.
- For high impact actions, require a named human who sees the real action, target and effect.
- Reject approvals from the requesting identity, and log the approver identity separately.
- Test by asking the agent, in a safe environment, to approve itself. It should fail.
Be careful with agent reviewers
An agent reviewing another agent can be a useful filter for quality. Treat it as advice. It should not replace a deterministic check or a person for actions that are expensive, destructive or hard to reverse.
Try it yourself
Click through it at your own pace, or open it full screen. See how a gate sits outside the code it checks and decides on policy, not on the author's say so.
Safeguard offers policies, gates and guardrails that enforce rules outside the model, and a free scan at https://gold.safeguard.sh/scan.
Quick check
Is a second AI model reviewing the first enough?
Not for high impact actions. Use a deterministic policy check or a human who sees the real action.
Where should the approval check live?
In the tool server or downstream system, so it runs regardless of what the model decides.
Sources
Last reviewed: 19 October 2026.
