How do you add human approval to an AI agent?

Match the gate to the blast radius of the action. For agent frameworks, use the built-in interrupt mechanism (LangGraph interrupt, the Claude Agent SDK permission callback) to pause execution and hand the decision to a human. For actions outside the framework (sending an email, writing to a CRM, moving money), build your own gate: hold the action in a database or draft state, surface it somewhere a human checks (chat, email, a review queue), and only execute once a human responds. The mechanism matters less than making the pause durable, so it survives a crash or a redeploy, and making the approval bound to the exact payload a human reviewed.

What is the difference between LangGraph interrupt and a custom approval queue?

LangGraph interrupt() pauses graph execution inside the framework and requires a checkpointer to persist state; a human resumes the run with a Command that supplies an approve, edit, reject, or respond decision, and the interrupted node re-executes from the start. A custom approval queue lives outside any agent framework, in your own database: an action is written as a pending row with a status, a human approves or rejects it through whatever interface you build (chat command, web form, email reply), and a worker picks up approved rows and executes them. Interrupt is tied to a specific framework and a specific run. A custom queue is framework-agnostic, survives independently of whether the agent process is even running, and is the right choice when the approval needs to outlive the agent session, such as a brief someone reviews a day later.

Should AI agents ever send emails without human review?

It depends on what is at stake and what you have measured, not on a blanket rule. OWASP lists this exact case in its LLM06:2025 Excessive Agency guidance: an application that posts content on a user’s behalf should include an approval step before the post goes out, because the downstream system, not the model, has to enforce the check. A reasonable pattern is to draft every outbound message for review by default, then allow unattended sending only for a narrow, measured slice, such as leads that clear an explicit confidence threshold, and only behind a flag you can turn off. Sending everything unattended from day one, before you know your false-positive rate, is the failure mode the gate exists to prevent.

How do I stop an AI agent from sending the wrong version after approval?

Bind the approval to a hash of the exact content a human saw, not to a record ID that content can still change under. A common pattern is to compute a digest (for example SHA-256) of the reviewed payload, issue a short-lived signed token over that digest at preview time, and require the execute step to re-verify the token against a freshly computed digest of what it is about to send. If the underlying row changed between preview and execute, or the token expired, the action is refused rather than silently sent. This closes the gap where an agent shows a human one version of a message or invoice and then executes a different, possibly-regenerated version after approval.

Does n8n support human in the loop for AI agents?

Yes. n8n’s AI Agent node supports pausing before a specific tool call and routing an approval request to a configured channel, including Slack, Microsoft Teams, Discord, Telegram, Google Chat, WhatsApp Business Cloud, Gmail, Microsoft Outlook, or n8n’s own built-in chat. A reviewer can approve or deny the call, and the request shows the tool name and the AI-determined arguments so the reviewer has context before deciding. This is separate from the general-purpose Wait node, which can pause any workflow, not just an AI Agent tool call, until a webhook or timeout fires.

Human in the Loop AI Agents: 5 Ways to Add Approval Gates

LangGraph, Claude Agent SDK, n8n, and Temporal compared for pausing AI agents before risky actions, organized by blast radius, not by which framework is popular