Policy Enforcement and Human Approval

A support agent correctly identifies a $5,000 refund, but that does not mean it should be allowed to execute it. The model can propose an action, but it cannot grant itself permission to perform it. Production systems therefore place a deterministic policy layer between the agent and side-effecting tools. This layer evaluates identity, permissions, risk, and current state, then decides whether to allow, deny, or require human approval.

This lesson focuses on designing that control boundary and safely handling actions that require human approval.

Why agents need an authorization layer

A production agent usually has three distinct paths in a request life cycle. It interprets user intent, plans tool usage, and then tries to invoke systems that change real state. The danger appears at the boundary between planning and execution. A simple way to think about it is this. The model may act like a sharp intern who drafts the correct form, but only the organization decides whether the form is valid to file right now.

The system therefore inserts a policy enforcement point between agent intent and tool execution. A policy enforcement point is a deterministic gate that receives a proposed action and returns an execution verdict without consulting model judgment. This gate becomes the only route to side-effecting APIs.

The gate exists because three classes of failure are common.

• Prompt injection: Untrusted content can manipulate the planner into proposing privileged actions.

• Hallucinated authority: The model can confidently assert permissions that do not exist.

• Stale context: The model may reason over an outdated state snapshot while the world has already changed. ...