Put a human approval gate in front of any agent action that is irreversible, external or sensitive, and make the gate show real arguments and be enforced on the server. A gate that fires on everything gets clicked through, and a gate only in the client can be skipped.
Why gates?
OWASP's Excessive Agency entry lists excessive autonomy as one root cause and gives an example: an extension that deletes a user's documents without any confirmation. Its prevention advice includes requiring user approval for high impact actions. The prompt injection entry says the same, recommending human in the loop controls for privileged operations.
The MCP tools specification says applications should present confirmation prompts so a human is in the loop, show which tools are exposed, and make tool invocation visible, and that clients should show tool inputs before calling the server to avoid accidental or malicious data exfiltration.
The checklist
Constructed example: a deployment agent can open pull requests, restart services and rotate keys. Use the items below to decide where gates go.
Which actions need a gate
- Is the action irreversible, such as deleting data or sending a message to a customer?
- Does it have an external effect, such as payment, publishing or email?
- Does it touch secrets, permissions or identity?
- Does it exceed a threshold, such as spend, row count or number of recipients?
- Is it the first time this agent does this kind of thing for this target?
For the example: opening a pull request needs no gate. Restarting a staging service needs logging only. Rotating a production key needs approval. Deleting a database needs approval from two people.
What the approver sees
- Does the prompt show the exact tool name and arguments, not a summary written by the model?
- Does it show the context: who asked, which task, what changed since the last step?
- Is the content that influenced the decision visible, such as the ticket text the agent read?
- Is the risk classification stated in plain words?
A summary written by the model can be wrong or manipulated, so show the raw call.
How the gate is enforced
- Does the server refuse the action without a valid approval token, even if the client skipped the prompt?
- Is the approval tied to one specific call, so it cannot be reused for a different one?
- Does the approval expire?
- Can the agent approve itself or another agent? It must not.
- Is the approver authorized for this action, with separate approvers for high risk ones?
How you avoid fatigue
- Are low risk actions handled by scopes and limits instead of prompts?
- Do you track approval rates? An approval rate near 100 percent with seconds per decision suggests rubber stamping.
- Do you batch similar low risk approvals with a clear summary rather than prompting for each?
How you learn from it
- Is every request, decision and outcome logged with the agent identity and approver?
- Do you review denied requests, since they show where the agent wants to go?
- Do you test the gate in your red team scenarios, including content that tries to talk the approver into saying yes?
Where does Safeguard fit?
Safeguard's MCP Guardrail applies policy to agent tool calls, and policies and gates apply controls in pull requests. Both fit into the enforcement items above. Auto remediation fix pull requests are off by default, so a person decides whether they are opened.
What to do
- Classify every agent tool as read, reversible write or high impact.
- Gate the high impact class on the server with call specific, expiring approvals.
- Show raw arguments and influencing context to the approver.
- Block self approval and route high risk actions to named approvers.
- Measure approval time and rate monthly.
- Add gate tests to your red team suite.
Quick check
Is a confirmation dialog in the client enough?
No. A client can be bypassed or misconfigured. The server should require a valid approval for high impact actions.
Should every agent action need approval?
No. Too many prompts lead to rubber stamping. Use scopes and limits for low risk actions and keep human approval for the high impact ones.
Sources
Last reviewed: 18 October 2026.
