AI assistants are increasingly given access to take action. Through integrations and standards such as MCP, an AI can send emails, update stock levels, create invoices, or reply to customers on behalf of a company. That saves a lot of time. The risk grows too, because a single misunderstanding by the AI can go straight to a customer or into the books.
Human-in-the-loop is how you keep that balance. The AI still does most of the work, but certain actions wait for a person to approve them before they run. This article covers which actions need approval, how to design approval steps that do not slow everyone down, and why an audit trail matters.
What human-in-the-loop means for AI
The term describes a workflow where a person reviews or approves the AI's output at specific points. It can be very simple. The AI drafts a reply to a customer, and a customer service agent reads it and presses send. It can also be more structured. An AI agent prepares a purchase order for a supplier, and the order goes into the warehouse manager's approval queue.
The key difference lies in the type of task. Reading data, summarising, and drafting are rarely dangerous, because the output has not gone anywhere yet. Risk appears when the AI takes an action that changes something in the real world, such as sending a message, changing a number, or moving money.
Actions that need human approval
Not every action needs approval. If every step has to be signed off, the AI stops saving time. Ask a few questions about each action. Can it be undone? Does it go to someone outside the company? Does it involve money or personal data? How much data does it touch?
As a rough guide, this is a common way to split them:
- Usually safe to run automatically: searching data, summarising documents, preparing drafts, sorting tickets, labelling emails.
- Better to wait for approval: messaging customers, changing prices or stock, creating or cancelling invoices, deleting data, bulk changes to many records.
- Better not to give to AI at all for now: fund transfers, changes to user permissions, and decisions about an employee's or client's status.
Where you draw the line depends on the business. An online store might let the AI answer shipping cost questions on its own, while a clinic wants staff to read every message that mentions a patient's condition first.
Designing practical approval steps
Show the planned action clearly
The approver should understand what will happen without reading technical logs. Show a plain-language summary, such as "Email an invoice for this amount to this customer", along with the data that will change. Give options to approve, reject, or edit before approving.
Decide who has authority
Approvals should follow the structure you already have. Price changes go to the sales manager, purchase orders to the warehouse manager, sensitive replies to a supervisor. For high-risk actions, the person who requested the action should not be the only one who can approve it.
Avoid approval fatigue
If people face hundreds of approval requests a day, they start clicking approve without reading. At that point approval is a formality. Reduce the volume by grouping similar actions, letting low-risk actions run on their own, and setting a time limit for requests that nobody responds to.
An audit trail for every AI action
An audit trail is a complete record of what the AI did. It should capture who made the request, what the AI proposed, which data it read, who approved or rejected it, when, and what happened as a result. When a customer complains about receiving a duplicate invoice, your team can trace exactly where the mistake came from.
Store this record somewhere the agent itself cannot modify, and set a retention period that fits company policy. Provide a view that non-technical people can read as well. An audit trail that only a developer can open is rarely used when it is actually needed, for example in a meeting with an unhappy customer.
In an MCP-based setup, every tool call the AI makes can be logged and permissioned per tool. An agent can be allowed to read order data without being able to change it. Per-tool permissions, approvals, and an audit trail together make AI use accountable to the business owner and to auditors.
Start in draft mode
The safest way to introduce an AI agent is to start in draft mode. For the first few weeks, the AI only prepares actions and a person approves all of them. Track how often staff change or reject what the AI proposes. Actions that are almost always approved unchanged are candidates to run automatically. Actions that are often corrected keep their approval step until quality improves.
This gradual approach also helps the team trust the system. Staff see how the AI behaves before it is given more authority. Review these boundaries regularly, especially after the AI model is changed or a business process shifts, since an action that used to be safe may not stay that way.
Agents that work with permissions and approvals
Through our MCP & AI Agents service, Averoa builds MCP servers that connect Claude or ChatGPT to your systems with OAuth, per-tool permissions, and audit logs. Risky actions such as changing data or sending messages can be set to wait for approval before they run.
