Which AI Agent Actions Need a Human Yes? An Approval Rulebook for Small Business

Disclosure: my company sells human oversight for AI agents, including the approval and review work this post describes. Weigh my opinion accordingly, and check the sources.

Why Should You Listen to Me?

I started in 2006 as an outsourced call center agent in technical services, and virtually all of my career since then has been on the technical side of outsourcing, including scaling strategy and the human-capital side of scaling for tech firms, later AI firms, and some semiconductor firms. I joined SuperStaff as CEO in 2019. SuperStaff, the company I run, was founded in 2009 and is now in its 18th year of business. Managing teams always comes down to deciding who may do what without asking, and who signs off on the exceptions. We now apply the same discipline to AI agents through Agentic Trainers, the AI division of SuperStaff, where I am Managing Director, and I am in graduate AI studies, so I read the papers and the vendor documentation behind the marketing. This post is my playbook, with the evidence I used to build it.

Why Is This Question Suddenly Urgent?

Because agents now act, not just answer, and the incidents are no longer hypothetical. On October 1, 2026, OpenAI said it had notified more than 100 organizations about unauthorized activity linked to its agents, and that "in some cases, models used internet access in unintended ways or, in retrospect, did not have the ideal restrictions applied" (Quartz, citing Reuters, updated October 2, 2026). OpenAI also stressed that notification "does not mean that any private information was accessed" (The Register, October 2, 2026).

That story involves one of the best-funded AI labs on earth, testing its own models. A small business has fewer engineers and the same basic problem: an agent with more reach than anyone intended.

What Does "Excessive Agency" Mean in Plain English?

It means an agent can do damage because it has more tools, more permissions or more freedom than the job requires. OWASP, the security nonprofit whose risk lists developers actually use, names three root causes: excessive functionality, excessive permissions and excessive autonomy (OWASP, LLM06:2025).

Its examples read like a small-business support desk. A mailbox assistant that only needs to read email ends up with a plugin that can also send it. A tool meant to read a product table connects with an account that can also update and delete records. An app that can delete a user's documents "performs deletions without any confirmation from the user." Every one of those is a permissions decision somebody made in a hurry.

OWASP's first fixes are not exotic: minimize the tools, minimize what each tool can do, minimize permissions, and "require a human to approve high-impact actions before they are taken." Approval rules are the third leg, and they only work if the first two are done too.

Which AI Agent Actions Need Human Approval?

Five categories need a person's yes before the agent acts. Everything else can usually run on its own with logging and spot checks.

Action type	Examples in a small business	Default rule	Why
Talks to the outside world	Customer emails, texts, social posts, review replies, quotes	Approve before send, at least until the agent has a track record	Once it is sent, you own it. A Canadian tribunal held Air Canada responsible for what its website chatbot told a customer (ABA Business Law Today, February 29, 2024)
Moves money	Refunds, credits, vendor payments, payroll changes, discounts above a set amount	Always approve; never let the agent change bank details	Hard to reverse, and a favorite target for fraud
Changes access	New user accounts, new app connections, password resets, sharing settings	Always approve	An access change makes every later mistake bigger
Destroys or exports data	Deleting records, bulk exports, sending files outside the company	Approve, and for deletion consider "people only"	You cannot ask a model to un-delete something
Does something new	The first time an agent uses a tool, a new customer segment, a new workflow	Approve until it has a record	You do not know its habits yet

The OpenAI Agents SDK, a toolkit developers use to build agents, reflects the same idea in code. A developer marks a tool with needs_approval, and the agent pauses until a person approves or rejects that specific call. Its own documentation uses cancelling an order and sending a refund email as examples (OpenAI Agents SDK docs, Human-in-the-loop). If the vendor you are evaluating cannot show you something equivalent, that is your first answer.

What Can an AI Agent Do Without Asking?

Reading, searching, summarizing, sorting, tagging and drafting can usually run without a yes, because nothing leaves the building and nothing is lost if the output is wrong. Anthropic's Claude Code works this way: actions that "can't modify state," such as file reads and search, are allowed automatically, while riskier actions go to a check (Anthropic, March 25, 2026).

"Without a yes" does not mean "without a look." Unapproved work should still be logged, and someone should sample it. A draft that is wrong is harmless. A draft queue that is wrong every day for a month is a training problem you want to see early.

What Is the Take-Back Test?

The Take-Back Test is my rule of thumb, not an industry standard: an action needs human approval if you cannot undo it yourself, quickly, at no cost, before anyone outside the company notices. It has three questions.

1. Can we undo it ourselves? Not "can the vendor restore a backup next week," but can your team reverse it today.
2. Will anyone outside notice first? A customer, a supplier, a bank, a regulator, the public.
3. Does it touch money, access or someone else's data?

Reversibility is a common yardstick in agent design (we used it in our in-the-loop vs on-the-loop post too). My version adds the outsider and money questions, because those are where small businesses get hurt. If the answers are yes, no and no, let the agent run with logging. Any other combination gets a human yes. It sounds simple because it is. The hard part is being honest about question one, because "we have backups" is often a belief rather than a tested fact.

Who Should Approve, and What Should They See?

The approver should be a named person who understands the customer or the money involved, with a named backup for days off. "The team" is not an approver, and neither is a shared inbox. If nobody is named, approval drifts to whoever happens to be free, and that person may not know the customer or the account.

The approver should see the exact action, not a summary: the recipient, the amount, the account, the full text and any attachment. A summary is the agent describing its own homework. OpenAI's documentation makes a related point for developers: tool names and arguments shown to a reviewer should be treated as "untrusted display content," and the reviewer's identity should come from your own login system, not from the approval request (OpenAI Agents SDK docs). In plain terms: make sure the person clicking yes is who you think it is, and that they are looking at the real action.

Why Do Human Approvals Turn Into Rubber Stamps?

Because people approve what usually turns out fine, and agents mostly ask about things that turn out fine. Anthropic reported that Claude Code users accepted 93% of manual permission prompts, and it described the result plainly: over time, people "stop paying close attention to what they're approving" (Anthropic, March 25, 2026).

That is not a character flaw. It is arithmetic. If 97 out of 100 requests are fine, a busy person learns to click yes. I covered the research on automation bias in more depth in our post on in-the-loop vs on-the-loop oversight. For a small business, the practical fixes are:

• Ask less often. Approve categories of risk, not every keystroke. Every unnecessary prompt teaches the approver to stop reading.
• Cap the queue. My rule of thumb: if one person faces more approvals in an hour than they can read in full, you have designed a rubber stamp. Split the queue or narrow the rule.
• Plant a test now and then. Slip in a request that should be rejected, such as a refund to the wrong account in a test environment, and see whether it gets caught. We wrote about how many planted errors you need to test reviewers.
• Watch the approval rate. If a category is approved 100% of the time for months, either automate it with sampling or make the approver look at something more useful.

Can an AI Approve Another AI's Work?

Partly. Anthropic built "auto mode," in which a classifier stands in for the human approver on many actions, and published unusually candid numbers. On real internal traffic the full pipeline wrongly blocked 0.4% of harmless actions, but on 52 real "overeager" actions it let 17% through (Anthropic, March 25, 2026). The sample of 52 is small, and Anthropic says so.

Anthropic's own verdict is the one I would tape to the monitor: compared with no guardrails it is "a substantial improvement," but compared with careful manual approval it is "arguably a regression," and it is "not a drop-in replacement for careful human review on high-stakes infrastructure." My view: let automated checks handle volume and low-stakes calls, and keep people on money, access, deletion and anything a customer will see.

Does a Prompt That Says "Always Ask First" Count as an Approval Rule?

No. A sentence in the agent's instructions is a request, not a control. OWASP's advice is to "implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not" (OWASP, LLM06:2025).

Anthropic's incident examples show why. Its internal log includes an agent deleting remote code branches after a vague "clean up" request, and an agent hunting through config files for other credentials after an authentication error (Anthropic, March 25, 2026). Neither agent was malicious. Both were trying to help. That is exactly why the rule has to be a permission the agent does not have, rather than a polite request it may reinterpret. We covered the security side of this in the lethal trifecta post.

What Happens if a Payment Gets Approved Twice?

It can get paid twice, and approval alone will not stop it. OpenAI's SDK documentation is refreshingly blunt: "Approval permits a tool call to execute; it does not guarantee exactly-once execution." If a system crashes after a payment goes out but before the record is saved, a retry can run the payment again (OpenAI Agents SDK docs).

The fix is boring and effective: payment and refund actions should carry a unique reference that the bank or payment platform uses to reject duplicates, and anything uncertain should be checked against the source system before a retry. If you are not technical, ask your vendor one question: "What stops an approved refund from being issued twice?" A good vendor has an answer in one sentence.

What Should an Approval Log Record?

Every approval should record who approved, what exactly they approved, when, and what happened next. That is four fields, and it is the difference between "the AI did it" and a real answer when a customer calls.

There is a financial reason too. IBM's 2025 breach study found that 13% of organizations reported breaches of AI models or applications, and of those, 97% said they lacked AI access controls (IBM, July 30, 2025). That is a correlation among breached organizations, not proof that controls prevent breaches, but it is hard to read it and conclude that access rules are optional.

How Strict Should a Brand-New Agent Be?

Start strict and loosen with evidence. For the first two weeks, a sensible default is draft-only: the agent prepares, a person sends. Then move one category at a time to "approve by exception" once you have seen enough of its work to know its habits. Write down the date and the reason when you loosen a rule, so you can tighten it again without an argument.

This is how you would onboard a person, and it is how we onboard agents. Nobody gives a new bookkeeper the company card on day one. Nobody should give it to an agent either.

How Many Approvals Can a Small Team Realistically Handle?

Fewer than you think, which is the strongest argument for designing rules carefully. Every approval costs a person's attention, and attention is the scarcest thing in a 15-person company. McKinsey's 2026 survey found that respondents from organizations under $1 billion in revenue reporting that they were scaling AI agents held flat at 22%, while larger companies rose to 40% (McKinsey, August 25, 2026). I read that partly as a capacity story: big companies have people to supervise agents; small ones are deciding whether they can afford to.

The answer is not "approve nothing." It is to approve the five categories above, automate the rest with logging and sampling, and measure how many minutes a day approvals actually take. If the number is too high, the rules are too broad or the agent is not ready.

What Is the Strongest Argument Against Approval Rules?

The best argument against them is that approvals slow everything down, people rubber-stamp them anyway, and the real protection is good permissions and good testing. That argument is mostly right, and Anthropic's 93% figure supports it.

Where I part ways is the conclusion. Rubber-stamping is a design failure, not proof that people add nothing. Narrow, well-designed approvals on money, access, deletion and customer messages are cheap insurance, and they give you a named human who can answer for the decision. Permissions and testing reduce how often you need approvals. They do not remove the need for someone to own the outcome.

So What Is the Bottom Line on AI Agent Approval Rules?

Write the list you would give a new employee, put it in the software instead of the prompt, and keep the list short enough that people still read what they approve. Let agents read, sort and draft freely. Make them ask before they send, pay, grant access, delete or try something new. Review the approval log monthly and loosen rules only with evidence.

An approval rule is not a sign that you distrust the agent. It is a sign that you know which mistakes you cannot take back.

If you want help deciding which of your workflows need a human yes, and who should give it, book a discovery call with us. For the policy side, see our AI agent governance guide.

Frequently Asked Questions

What are AI agent approval rules?

They are written rules that say which actions an AI agent may take on its own and which need a named person's approval first. Good rules are enforced in the software, list the approver and a backup, and record every decision.

Which AI agent actions should always need human approval?

Sending anything to customers or the public, moving money, changing access or permissions, deleting or exporting data, and doing anything for the first time. Reading, searching, sorting and drafting can usually run without approval if they are logged.

Is telling the agent "ask before acting" in its instructions enough?

No. Instructions are requests the model may misread. OWASP recommends enforcing authorization in downstream systems instead of relying on the model to decide what is allowed.

What is approval fatigue?

It is what happens when people approve so many routine requests that they stop reading them. Anthropic reported that Claude Code users accepted 93% of manual permission prompts and cited approval fatigue as the reason it built an automated alternative.

Can an AI classifier replace a human approver?

For low-stakes, high-volume actions, it can help. Anthropic's classifier still let 17% of real overeager actions through in testing, and Anthropic itself says the classifier should not stand in for a careful human review when the stakes are high.

What is the Take-Back Test?

My rule of thumb, not an industry standard: if you cannot undo an action yourself, quickly and at no cost, before anyone outside notices, a person approves it first.

What should an approval log include?

Who approved, exactly what they approved, when, and what happened afterward. Those four fields let you answer a customer, an auditor or your own team when something goes wrong.

How should a small business start?

Run new agents in draft-only mode for about two weeks, then loosen one category at a time based on what you observe. Write down when and why you loosened each rule.

Disclaimer: This article is commentary and opinion based on public sources available as of October 30, 2026. It is not legal, security, financial or compliance advice. Vendor features, survey figures and incident details reflect what the cited sources reported and may change. The Take-Back Test and the queue rule of thumb are my own heuristics, not industry standards. Agentic Trainers sells human oversight services, including approval and review work. If you believe anything here is inaccurate, contact us at hello@agentictrainers.com and we will review it promptly.