Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To make sure an AI agent does only what a person approved, bind the approval to the exact artifact or action the reviewer saw, then verify that identity again immediately before execution. A green approval button alone is not enough: the record should identify the approver, approved content, allowed scope, timing, and resulting action.
Why approval must follow the artifact, not its label
An approval can become meaningless if the agent or another system changes the content after review. A reviewer might approve a draft, deployment, or tool call, while the system later executes a modified version under the same task name. This is a time-of-check/time-of-use gap: the content checked and the content used are no longer necessarily the same.
Use a stable identity for the pending artifact—often a digest computed from canonical content—rather than a mutable label such as a task title or version name. Define canonicalization explicitly so the same content is represented consistently, and edits result in a new identity. Approval should name both that identity and the action it authorizes.
A practical approval flow
- Create a concrete pending artifact. The agent should produce the actual content or action request, not merely a narrative promise about what it intends to do. Assign it a stable identity.
- Show the reviewer the pending content and context. Use a trusted review surface that presents the payload, or a faithful representation of it, along with the consequences and scope. Do not rely solely on the agent’s summary of its own proposed action.
- Authenticate the approver and record a scoped decision. Tie the decision to the artifact identity, permitted action, relevant policy, and any time limit. A decision to approve a plan should not silently become permission to execute a broader action.
- Verify the identity at execution time. Recompute or retrieve the identity of the content that will actually be sent, published, committed, or otherwise made effective. Compare it with the approval record; if it differs, pause, reject, or request fresh approval.
- Preserve an end-to-end audit record. Connect the task, authenticated reviewer, approved identity and scope, execution event, and outcome so an auditor can determine what was authorized and what happened.
What a reviewer should be able to see
The review interface should make the actual pending action understandable, not just display an approval prompt. For a deployment, that may mean the artifact and relevant provenance; for a tool call, the exact parameters and intended effect. The interface should make clear what will happen if approved and what the approval does not cover.
TAP’s documentation describes an approval checkpoint that sends the exact payload to an approver before forwarding it. This is a vendor’s description of its own behavior, not independent validation of a particular deployment. TAP documentation
What to evaluate in an implementation
Compare systems and internal designs by their control behavior, rather than by how polished the approval button looks.
Rank #2
- Displayed content: Can the reviewer inspect the full pending payload or artifact, including material context, rather than only an agent-generated summary?
- Identity binding: Does the approval refer to a digest or another stable identity for the reviewed content?
- Reviewer authentication: Can the record establish which person approved, rather than merely that an approval event occurred?
- Scope and expiry: Is the authorized action explicit, and does the approval have a defined time window where appropriate?
- Execution-time check: Is the content’s identity checked again immediately before it takes effect?
- Mismatch handling: Does a changed artifact fail closed, pause for review, or trigger reapproval instead of proceeding?
- Audit linkage: Can records connect the approval to the exact eventual action and its result?
- Risk escalation: Can high-impact actions be denied, paused, or routed to a more appropriate reviewer?
ACS describes an approach with an authenticated approver and logged decisions. Agent Control Standard: Agents HARP describes approval bound to an artifact hash and re-verification, while GitLab’s security guidance discusses binding deployment decisions to a verified artifact by digest and provenance. These are protocol and vendor-published descriptions of mechanisms, not independent evaluations of every implementation. HARP specification overview GitLab Security Standard
Free tools Windows power users keep installed
One-click scans. No signup required.
Where human review matters most
Human review is most useful when an action has significant impact, is difficult to reverse, or crosses a meaningful boundary such as publishing, deploying, granting access, or spending money. It should complement clear accountability and ongoing monitoring, not substitute for them. Australian Government guidance calls for review at key stages and human intervention for irreversible or high-risk actions in its own government context; it is guidance, not a universal legal requirement. Australian Government: Agentic AI Addendum statements
Rank #3
Understand what the specifications and product pages establish
Protocol pages, draft specifications, government guidance, and product documentation have different levels of authority. They can provide useful design patterns, but a description of a mechanism does not prove that a deployment implements it correctly or securely.
Quick Recap
- The Agent Manifest v0.2 page is labeled a draft for review. Its approval-record concepts include approver identity, time, an evidence hash, duration, and revocation information; treat these as proposed design ideas, not settled standard practice. Agent Manifest Specification v0.2
- HLP identifies its material as draft v0.2.0. Confirm implementation status and maturity before relying on it for a production control. Human Loop Protocol
- ACS describes governance concepts, and HARP describes a protocol design. Their pages are not independent security assessments of a deployed system. ACS Agents HARP specification overview
- TAP and GitLab publish descriptions of their own products or standards. Verify the behavior and configuration available in the specific deployment rather than treating a feature description as proof. TAP documentation GitLab Security Standard
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
