To make an AI agent carry out only what a person approved, bind approval to the exact pending artifact or action—not to a mutable name or a general description. Show the reviewer what will happen, record their decision against a stable identity and explicit scope, then check that identity again immediately before execution. If it differs, stop and ask for fresh approval.
What an approval needs to cover
An approval is meaningful only when it refers to the same content or action that is later executed, published, committed, or otherwise made effective. A button click alone does not establish that link. The record should identify the reviewer, the approved artifact, the permitted action and scope, the decision time, and the eventual execution event.
As an Amazon Associate I earn from qualifying purchases.
For a practical design, compare implementations on these points:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Does the reviewer see the full pending payload, or a faithful representation of it?
- Is approval tied to a stable identity, such as a digest of the artifact?
- How is the reviewer authenticated?
- Are action scope and any expiry explicit?
- Does the system check for changes immediately before execution?
- What happens if the artifact no longer matches?
- Can the audit record connect the approval to the action and its result?
- Can high-risk actions be paused, denied, or escalated?
A control flow that ties review to execution
- Create a concrete pending action. Have the agent produce the actual proposed artifact or action, not just a natural-language description. Assign it a stable identity. A content digest can serve this purpose, provided the system defines how content is canonicalized so equivalent representations are handled consistently. The Agent Manifest specification discusses hashable artifacts and approval records, but identifies itself as a draft for review: Agent Manifest Specification v0.2.
- Display the pending content in a trusted review surface. Show the payload or a representation that faithfully reflects what the system will send or change. Do not rely only on the agent’s summary of its own action. TAP describes an approval checkpoint that sends the exact payload to the approver before forwarding it; this is a vendor description, not independent verification of a deployment: TAP documentation.
- Authenticate the reviewer and record a scoped decision. Store who approved, which artifact identity they saw, what action and scope they authorized, and any time limit. The Agent Manifest draft describes an approval record with approver identity, time, evidence hash, duration, and a revocation signature. These are proposed design concepts, not settled standard practice.
- Verify again at the point of execution. Recompute or retrieve the pending artifact’s identity and compare it with the approval record immediately before dispatch, release, or commit. If the values differ, reject or pause the action and request another review. HARP describes approval tied to an artifact hash and re-verification in its protocol overview; that description is not independent validation of implementations: HARP Spec Overview.
- Keep an audit trail through the outcome. Connect the task, reviewer, approved identity, scope or policy, execution event, and result. Agent Control Standard describes authenticated approvers and decision logging; TAP describes logging the agent, credential, approval status, and latency. Australia’s agentic AI guidance emphasizes traceable accountability: Agent Control Standard: Agents and Australian Government agentic AI lifecycle guidance.
Where approval controls commonly fail
The artifact changes after review
This is a time-of-check/time-of-use problem: an agent, user, or downstream service changes content after the human sees it but before it takes effect. A last-moment identity check is designed to detect that drift. GitLab’s vendor-published security guidance says deployment decisions should bind to the exact verified artifact by digest and provenance: GitLab Security Standard.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The approval is broader than the review
A person may think they approved a draft or plan while the system treats the click as permission to perform a broader action. Record the allowed action and scope alongside the artifact identity; require a new decision if either changes.
The review screen does not match the payload
A summary can omit material content or differ from what a downstream service receives. The review surface should display the pending payload or a faithful representation, and the system should preserve the identity of the content actually approved.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The log records a click but not an accountable decision
An entry saying “approved” is weak evidence if it does not establish which authenticated person approved which artifact and action. Agent Control Standard describes approver authentication and decision logging, while the Agent Manifest draft proposes an approver-attributable record with an evidence hash.
How to assess protocols, guidance, and product claims
Sources describing approval mechanisms are not all the same kind of evidence. Treat their maturity and context carefully:
Quick Recap
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Rank #3
- Government guidance: Australia’s agentic AI addendum addresses oversight, accountability, monitoring, and intervention, including human intervention for irreversible or high-risk actions. It is guidance for Australian Government contexts, not a universal legal rule. Read the guidance.
- Protocol and standards documentation: Agent Control Standard describes a governance model with authenticated approvers and logged decisions. HARP and the Human Loop Protocol describe protocol designs; the HLP page identifies its specification as draft v0.2.0. Check implementation and maturity rather than assuming a described mechanism is deployed or effective. Agent Control Standard, HARP, and Human Loop Protocol.
- Draft specification: Agent Manifest v0.2 is labeled a draft for review and dated August 2026 in the available specification listing. Its artifact-binding and approval-record concepts can inform a design, but it is not an established consensus standard. Agent Manifest Specification v0.2.
- Vendor documentation: TAP describes its own credential proxy and approval checkpoint, and GitLab describes its own security standard. These pages are useful for understanding their stated mechanisms, not as independent evaluations of a particular deployment. TAP and GitLab Security Standard.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
