Approval Gates
Human Checkpoints Inside Autonomous Workflows
Unlike upfront plan review, Approval Gates are embedded inside long-running workflows. The agent pauses at predefined checkpoints, shows what it plans to do next, and waits for human sign-off before proceeding. The safety net for high-stakes agentic execution.
Framing
The problem
Long-running automation needs human checkpoints inside the flow, not just at the start.
The pattern
Pause execution at predefined gates for approval, edit, or abort.
Why chat breaks here
Conversation cannot reliably interrupt hidden downstream steps at the right moment.
Risks
Too many gates destroy automation gains and train users to rubber-stamp.
Avoid when
The sequence is fully reversible and low-risk end to end.
Use when
Long-running automation has discrete decision points that require human judgement mid-flow.
DOPE evaluation
- Directability
- Approve, edit the plan, or abort at each checkpoint
- Observability
- Upcoming actions visible at each gate before execution
- Predictability
- Gate positions are predefined — users know exactly when they'll be asked
- Explainability
- Each gate shows what the agent plans to do next and why before proceeding
In the wild
- LangGraph Human-in-the-Loop (LangChain) — interrupt() plus the human-in-the-loop middleware: a tool call matching the configured mapping pauses the graph, state is checkpointed so the run can resume later, and the human returns approve, edit, reject or respond. The gate fires on the tool itself, not on a classifier's read of it. The canonical developer-API expression of the pattern.
- n8n Human Review Step (n8n) — n8n 2.6 (Jan 2026) put the gate on the Agent-to-tool connection: 'Add human review step' opens the Tools panel, you pick a channel — Slack, Teams, Gmail, Telegram, in-app chat — and the gated tool cannot run until someone hits Approve. Deny cancels the action outright. No Wait node to wire up.
- Cursor Agent Run Modes (Cursor) — Three run modes — Auto-review (the docs' recommended default since 3.6, May 2026), Allowlist, Run Everything. A classifier triages Shell, MCP and Fetch calls: known-safe ones run, riskier ones are held for approval. Gate positions are no longer predefined, and the old step cap is gone — the docs now say tool calls are unlimited.
- Magentic-UI: Human-in-the-Loop Agentic Systems (Academic source · Mozannar, Bansal, Tan et al. (Microsoft Research, Jul 2025)) — Gates by irreversibility rather than by tool category: every proposed action carries an always / maybe / never-irreversible class, and the ambiguous middle goes to an LLM judge before the human sees it. The shipped build defaults to require_approval_untrusted — read-only calls auto-approved, untrusted ones prompted.
FAQ
When should I use the Approval Gates pattern?
Long-running automation has discrete decision points that require human judgement mid-flow.
When should I avoid the Approval Gates pattern?
The sequence is fully reversible and low-risk end to end.
What problem does Approval Gates solve?
Long-running automation needs human checkpoints inside the flow, not just at the start.
Why is chat the wrong fit for this?
Conversation cannot reliably interrupt hidden downstream steps at the right moment.
Related patterns
- Often paired with: Intent Preview — Preview at the start; gates inside the run — together they cover the whole arc.
- Often paired with: Action Audit & Undo — Gates catch high-risk steps live; the audit log keeps everything reviewable.
- Often paired with: Autonomy Dial — Lower autonomy categories trigger more gates; the two settings reinforce each other.