Human Approval and Multi-Step Workflows
For consequential actions, let the model prepare a proposal and ask a human to approve it before execution. The approval should bind to the exact action payload, target, and relevant version; otherwise an attacker or race could change the payload after approval. Re-check permissions and state at execution time.
A workflow state machine is often more reliable than an unconstrained agent: drafted → awaiting_approval → approved → executing → completed with explicit failure and cancellation states. Store state durably so a process restart does not lose the workflow. Define who can approve, how approvals expire, and how rejected requests are handled.
Approval state model
drafted
-> awaiting_approval
-> rejected
-> approved
-> executing
-> completed
-> failed / retryable💡 Each transition should be validated by server-side policy. Approval should refer to a specific payload hash or immutable action record, and the executor should revalidate the target before acting.
Key Takeaways
- Use state machines for durable multi-step workflows.
- Approval must bind to the exact action.
- Re-check permissions and current state before execution.
Knowledge Check
What should an approval bind to for a high-impact action?