Allowlists handle the obviously safe. Denylists handle the obviously forbidden. Everything in between — the refund over $50, the email to a new recipient, the deployment to staging — needs a human verdict, fast.
Route by risk tier, not by gut
Give each agent a risk tier — low, medium, high — and define which action verbs escalate:
- Low-tier agents (readers, summarizers): only destructive verbs like delete or pay escalate.
- Medium-tier agents (support, research): anything with external side effects escalates — sending, publishing, spending above a threshold.
- High-tier agents (billing, deploy): every write action escalates. Reads stay automatic so the agent isn't paralyzed.
Make the decision take seconds, not minutes
An approval queue dies when deciding is slower than the task. Each request should show the approver: what the agent wants to do, in plain words; the estimated cost; why it escalated (which policy rule matched); and the blast radius (which system it touches). Approve and deny should be one tap each, on a phone, without logging in — a signed single-use link beats an auth wall when the approver is at dinner.
Set SLAs and expire gracefully
Pending approvals should expire. An approval that sits for 24 hours is a decision nobody made — treat expiry as denial by default, and let the agent be told so it can re-plan. Measure median decision time; if it drifts past 15 minutes, your routing is too broad and agents learn to route around the queue.
Log the decision, not just the outcome
Every decision needs an audit record: who decided, when, what they saw, and the reason they gave. When an incident review asks "who approved this refund?", the answer should be one query away. This is also what makes approval queues defensible with auditors and customers — it's a human checkpoint with a paper trail, not a rubber stamp.
Keep the queue narrow
The anti-pattern is approving everything. If more than ~5% of an agent's actions need approval, the tiering is wrong — tighten allowlists for the routine stuff and reserve the queue for genuinely ambiguous calls. A queue that approves 200 items a day trains approvers to click without reading.