Human Approval Before Sending AI-Prepared Documents

Review the action, not just the prose

A reviewer may be asked to approve a polished summary while the consequential action sits out of sight. In a document workflow, the real question might be whether to send a document for signature to a particular recipient, update a customer record, or replace an attachment. A useful review gate shows the proposed action, its target, the information used to prepare it, and what will happen after approval.

Place the gate at the point where an action would have an external or difficult-to-reverse effect. Drafting a checklist and sending a packet are different permissions, even if one follows the other in a single workflow. OWASP recommends explicit approval for high-impact actions and an action preview before execution; its excessive-agency guidance also calls for human approval before such actions occur.

Present a decision-ready review card

Before sending an SOW for signature, show the approver the client name, intended signer, final file and version, unresolved issues, and the exact action: “Send for signature.” The reviewer needs a clear way to approve, reject, or return the packet for correction. If the file or recipient changes, ask for approval again. A gate that hides these details risks becoming a reflexive click rather than a meaningful check.

Show the basis for the agent’s proposal without pretending that a generated explanation proves correctness. For example, a card might state that a contact name came from an intake form and that finance has not confirmed the billing contact. This lets the reviewer inspect the right evidence and request clarification. Do not hide an uncertain field inside a general “looks ready” status or treat a model’s confidence as approval.

Bind approval to the exact proposed action

Approval of one recipient and one attachment set should not authorize a later, changed packet. If any material parameter changes after review, return the action to the appropriate gate. Record who approved it, what they saw, the target and parameters, and when the approval expires. This is an implementation principle rather than a claim that every existing workflow already captures those details.

Separate the agent’s recommendation from the system that enforces authorization. The execution component should check permissions and approval state instead of accepting the agent’s assertion that approval was obtained. OWASP’s agent security guidance recommends binding approvals to an exact action and independently validating scope and privilege before high-impact execution.

Plan for rejection and absence

A review gate is incomplete if it only defines the approve button. Specify what happens when a reviewer rejects a proposed send, asks for a corrected attachment, or is unavailable. A rejected action should remain stopped while its owner receives a usable reason and a route to resubmit. An agent should not quietly retry the same action with reworded justification.

Run a short exercise with the people who will actually review the work. Give them a correct packet, a packet with a wrong recipient, and one whose contents changed after initial approval. Ask whether the interface makes the difference obvious. If not, improve the review card or move the gate. Human oversight is a designed workflow with enough context and time to act, not a label applied to automation afterward.

Sources and further reading

• OWASP AI Agent Security Cheat Sheet
• OWASP LLM06:2025 Excessive Agency