Owned intelligence, governed from the first call.

Guide

Step-Up Approval for AI Agents: A Named Human on Every High-Risk Action

Craig Alberino · · 10 min read
Step-Up Approval for AI Agents: A Named Human on Every High-Risk Action

Step-up approval pauses an AI agent's high-risk action, such as a payment, a change to a customer record or a message sent in the firm's name, until the person whose authority the agent is using approves it, with proof that person was there. The decision is made per action, before the call executes, and the approval joins the record.

Agents act on delegated authority, at machine speed, across every model and tool they reach. An access check confirms that an agent may call a payments API. It cannot tell whether this payment, to this payee, for this amount, is one the person behind the agent would make.

This guide covers why access checks stop short, what standards bodies and supervisors now ask for, how a step-up works, which actions should require one, and how to keep approvals meaningful.

Regulatory references verified as of October 21, 2026.

Why access checks stop short

Identity and access management answers two questions: who is calling, and may that caller use this resource. For people, that is usually enough, because the person is present and chooses each action. An agent changes the second half. It holds a person's access and chooses the actions itself.

OWASP calls the result excessive agency. Its Top 10 for LLM Applications (2025 edition; the 2026 edition moved Excessive Agency to third) traces the risk to "excessive functionality," "excessive permissions" and "excessive autonomy," and gives the last one a concrete form: "An LLM-based application or extension fails to independently verify and approve high-impact actions." Its mitigation is direct: "Utilise human-in-the-loop control to require a human to approve high-impact actions before they are taken."

The OWASP Top 10 for Agentic Applications, published in December 2025, carries the same control into the agent-specific list. Under ASI03, Identity and Privilege Abuse, it tells teams to "[r]equire human approval for high-privilege or irreversible actions" as a safety net against privilege escalation.

The Model Context Protocol, an open protocol many agents use to reach tools, states the principle in its specification. Tools are designed to be "model-controlled," which means the model can discover and invoke them on its own, and "there SHOULD always be a human in the loop with the ability to deny tool invocations." The same specification states that "MCP itself cannot enforce these security principles at the protocol level." Enforcement falls to whoever runs the estate. The MCP security entry covers the tool path.

A public case shows the gap. In July 2025, an AI coding agent on Replit deleted a live production database during a code freeze, Fortune reported, wiping out data for more than 1,200 executives. The user had told the agent not to make changes without explicit approval. Replit's chief executive, Amjad Masad, wrote that the deletion was "[u]nacceptable and should never be possible." The instruction sat in the agent's input, alongside everything else the model weighed. An approval step outside the model requires a named person's decision before the command runs.

What standards bodies and supervisors ask for

The guidance has converged on the same control.

  • Five Eyes cybersecurity agencies. On April 30, 2026, ASD's ACSC, CISA, the NSA, the Canadian Centre for Cyber Security, NCSC-NZ and the UK NCSC published Careful Adoption of Agentic AI Services. It tells operators to "Prevent agents from autonomously executing high impact actions or outputs without prior human approval," and to "Quarantine requests to delete logs or audit records until reviewed and approved by a human." Our summary of the advisory covers the rest.
  • The EU AI Act. Article 14 requires that high-risk systems "can be effectively overseen by natural persons," and that the people assigned can "decide, in any particular situation, not to use the high-risk AI system or to otherwise disregard, override or reverse the output." Under Regulation (EU) 2026/1744, those obligations apply to the stand-alone high-risk systems of Annex III from December 2, 2027.
  • FINRA. Regulatory Notice 24-09 of June 27, 2024 reminds member firms that FINRA's rules "are intended to be technology neutral" and continue to apply when firms use generative AI. Under Rule 3110, a firm "must have a reasonably designed supervisory system" tailored to its business. That obligation stays the same when an agent takes the action. The FINRA 3110 guide covers supervision of AI in detail.

Courts have reached the accountability point from the other side. In Moffatt v. Air Canada, decided February 14, 2024, the British Columbia Civil Resolution Tribunal rejected the airline's suggestion that its chatbot was a separate legal entity responsible for its own actions: "It should be obvious to Air Canada that it is responsible for all the information on its website." A firm owns what its automation does.

How a step-up works

A step-up has six parts. Each has to work the same way whichever model proposed the action.

One step-up, six parts: the agent proposes a call, policy reads the arguments, the action pauses, the named person receives it, the person proves presence and decides, and the decision joins the record. Inside the limits the action proceeds; beyond them it waits. Step up on payments, customer records, messages in the firm's name, access grants and deletions.
One step-up, six parts, per action, before the call executes.
  1. The agent proposes a call. It has chosen a tool and the arguments: pay this invoice, update this record, send this message.
  2. Policy reads the arguments. Before the call executes, the policy compares the call with the authority the person delegated: amount limits, payees, record types, recipients, data classes. An action inside the limits proceeds.
  3. The action pauses. An action beyond the limits waits. The agent keeps no path around the wait.
  4. The request goes to a named person. The person whose authority the agent is using, or a named approver with that right, receives the request on a device of their own. A shared queue spreads the accountability across everyone who can see it.
  5. The person proves presence and decides. They authenticate strongly at the moment of the decision, see exactly what they are approving, and approve or deny.
  6. The decision joins the record. The record names the person, the agent, the model, the action and its arguments, the policy that triggered the step-up, the decision and the time.

Open standards already cover the identity steps. RFC 9470, the OAuth 2.0 Step Up Authentication Challenge Protocol published by the IETF in September 2023, lets a resource server tell a client that "the authentication event associated with the access token of the current request does not meet its authentication requirements," and say how strong (acr_values) and how recent (max_age) the authentication must be. OpenID Connect Client-Initiated Backchannel Authentication (CIBA) separates the device that starts a request from the one that approves it: the user "authenticates and grants consent on the Authentication Device," often a smartphone, and a short binding message can appear on both devices so the approver can tie the request to the transaction that triggered it. The OpenID Foundation's October 2025 whitepaper on identity management for agentic AI points to CIBA for agents that need to pause and request explicit user approval.

Session strength is measured in hours. NIST SP 800-63B-4, final since July 2025, defines AAL2 as "high confidence that the claimant controls one or more authenticators" and sets the reauthentication timeout at no more than 24 hours. A sign-in at nine in the morning says little about who stood behind a payment at four in the afternoon. Per-action step-up asks for proof at the moment the action needs it.

The agent authority scope entry covers how delegated limits are written, and the glossary entry on human in the loop separates gating an action from monitoring it afterward.

Which actions should step up

Approval works when it is rare enough to be read. Start with the actions that move money, change the record, speak for the firm or remove the evidence.

Action class Examples Who approves What the record keeps
Payments and transfers A wire, a vendor payment, a refund above a set amount The person whose authority the agent is using, or a named approver above that limit Amount, payee, account, the limit exceeded, the approver and the time
Changes to customer records Address, beneficiary, credit limit, account status The record owner or a supervisor with approval rights Field, old and new values, the customer, the approver
Messages in the firm's name Client communications, regulatory filings, public posts The person accountable for the communication Recipient, content, channel, the approver
Access and entitlements Granting roles, sharing data outside the firm, creating credentials The system owner Entitlement, grantee, scope, duration, the approver
Deletion and production changes Deleting data or logs, changes to production systems The system owner, with a second approver for logs What was deleted or changed, why, both approvers

Each line sets a threshold and names a person. Thresholds follow the person who delegated them: an analyst who may approve $10,000 cannot delegate $50,000 of authority to an agent.

Keeping approvals meaningful

An approval that is always granted is a rubber stamp. Article 14 of the AI Act names the risk: the people overseeing a high-risk system must remain aware of "the possible tendency of automatically relying or over-relying on the output," which it calls automation bias.

Three practices keep the step-up a decision.

  • Ask rarely. Step up only on actions beyond the delegated limits. An agent that asks for approval on every call trains its approvers to click yes.
  • Show the specifics. The request shows the action, the arguments, the limit exceeded and why, in plain language. "Approve agent action?" is not enough to decide on.
  • Route to the right person. The person whose authority is in use, or a named approver with that right. Never a team inbox.

Questions to ask about your own agents

  • Which of your agents can move money, change a customer record or send a message in the firm's name?
  • When one of them exceeds its limits, does the action pause, and who receives the request?
  • Does the approver authenticate at the moment of the decision, and see exactly what they are approving?
  • Can the agent reach the same tool by another path that skips the approval?
  • Where is the approval recorded, and does the record name the model as well as the person?

How APERION handles high-risk actions

Owned intelligence, governed from the first call. APERION future-proofs the hybrid AI estate: every agent and every model an enterprise rents or owns, governed from one control point inside its own walls. The control point sits in the path between agents and every model and tool they call, rented or owned, and keeps each action inside the authority a person delegated.

The proof is one call. An agent tried to wire $50,000 nobody approved. The amount exceeded the authority delegated to the agent. The action paused and went back to the person whose authority the agent was using, who decided with proof they were there. The accountable human decides, and the record shows who decided, when and under which policy.

The Trust Fabric sets out the four layers underneath: verified identity, access governance, runtime governance, and audit and evidence. The thesis is set out on AI governance.

A verified person, the authority that person delegated, the agent that used it, the policy that applied, the decision and the record of all of it. That chain is the product.

Frequently asked questions

What is step-up approval for AI agents?

Step-up approval pauses a high-risk action an agent proposes, such as a payment or a change to a customer record, until the person whose authority the agent is using approves it with proof they were there. The check runs per action, before the call executes, against the limits that person delegated. Actions inside the limits proceed, and every decision joins the record.

How is step-up approval different from human in the loop?

Human in the loop is the broad principle that a person can oversee and stop an AI system. Step-up approval is one specific form of it: a gate on individual actions that exceed delegated limits, routed to a named person who authenticates at the moment of the decision. Reviewing logs after the fact is also human oversight, but it decides nothing before the action runs.

Which AI agent actions should require human approval?

Start with actions that move money, change customer records, send messages in the firm's name, grant access or delete data and logs. OWASP recommends human approval for high-impact actions, and the April 2026 Five Eyes guidance says agents should not execute high-impact actions without prior human approval. Set thresholds per person, so an agent never holds more authority than the person who delegated it.

Does an agent's access token prove the user approved the action?

No. A token shows that a person signed in and granted access, sometimes hours earlier. NIST SP 800-63B-4 sets the AAL2 reauthentication timeout at no more than 24 hours. Proving that a person approved a specific action needs a fresh authentication at that moment, tied to that action, which standards such as RFC 9470 and OpenID CIBA support.

Does the EU AI Act require human approval for AI agents?

Article 14 requires that high-risk AI systems can be effectively overseen by people who can override, reverse or stop them, and that those people stay aware of automation bias. For the stand-alone high-risk systems of Annex III, those obligations apply from December 2, 2027, under Regulation (EU) 2026/1744. Agents outside the high-risk categories still fall under the firm's own supervisory obligations.

How do you avoid approval fatigue?

Ask rarely, show specifics and route to the right person. Step up only when an action exceeds the delegated limits, show the action, arguments and limit in plain language, and send the request to the person whose authority is in use.

Sources

Related reading

GuidesAI AgentsAI GovernanceRuntime Governance
Craig Alberino
Craig Alberino
Craig Alberino is the Co-Founder and CEO of APERION, which builds the runtime governance layer for AI agents in regulated enterprises. Inline policy enforcement and identity-bound audit, deployable on premises.

Put this in the path of your own agents.

Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.

Request a Demo Read the docs