The outcome
Ensure a model cannot bypass approval for purchases, messages, deletions, deployments, or other material side effects.
Step by step
A workflow you can repeat.
- 01
Identify the exact action, approver, evidence, expiry, modification rights, rejection path, and idempotency key required for the decision.
- 02
Use a graph-enforced interrupt when approval is mandatory, reserving model-initiated human-in-the-loop tools for optional clarification or expert input.
- 03
Render the complete proposed action with destination, payload, cost, risks, and source evidence; never approve from an ambiguous summary.
- 04
Validate the resumed decision server-side, bind it to the user and pending action, reject stale or replayed responses, and execute the side effect once.
- 05
Test approval, rejection, editing, disconnect, timeout, duplicate resume, backend restart, partial success, audit logging, and safe recovery.
Working standard
What good use looks like.
- Use deterministic interrupts for mandatory gates.
- Bind approval to one exact action.
- Make execution idempotent.
Official references