Learn · AI Governance

What is human-in-the-loop approval?

Short answer. Human-in-the-loop approval means an AI can prepare an action, such as an email, payment or publication, but a named person must approve it before it happens. It keeps accountability with people while letting AI do the preparation.

Last reviewed 24 September 2026

The idea

AI is good at preparation: drafting, compiling, checking and suggesting. It is less suited to carrying final responsibility for actions with consequences. Human-in-the-loop approval divides the work accordingly. The AI prepares; a person decides.

In practice, that means an AI can create a draft email, a proposed invoice, a change to a record or a page ready to publish, and the action waits until someone with the authority to approve it says yes.

Which actions need approval

A useful test: would we be uncomfortable if this happened without anyone looking? Common candidates:

  • External communication: emails, letters and messages to clients or suppliers.
  • Financial actions: invoices, payments, journal entries, bank details.
  • Publication: anything going on a public website or to a client portal.
  • Deletion: removing records, files or data.
  • Changes to access: granting permissions or sharing information externally.
  • Deployment: releasing software to production.

Reading and drafting usually do not need approval. Approving every small step creates fatigue and teaches people to click “approve” without reading.

What a good approval looks like

  1. The right approver. A person with authority for that action, not just whoever is available. A client email might need the responsible manager; a payment might need a partner.
  2. Enough context. The approver sees exactly what will happen: the recipient, the content, the amount, the target.
  3. The ability to change or reject. Approval is a decision, not a formality.
  4. Enforcement. The action is technically impossible until approved. A rule in a policy document that the AI can ignore is not approval.
  5. A record. Who approved, when, and what exactly they approved.

Approval versus review

Reviewing AI output after the fact is useful, but it is not the same. Once an email has been sent or a payment made, review can only find the problem. Approval prevents it.

Avoiding approval fatigue

  • Require approval for consequential actions only.
  • Batch similar approvals, such as a set of reminder drafts, where sensible.
  • Make the approval screen clear and quick to read.
  • Review approval patterns. If everything is approved unchanged, consider whether the rule is in the right place; if much is rejected, the AI’s instructions may need work.

In regulated professions

Professional bodies generally expect practitioners to remain responsible for work done in their name, whoever or whatever prepared it. Approval by a responsible person is a practical way to make that true for AI-prepared work. Check your own professional body’s guidance.

How Kroy approaches it

Approval is one of Kroy’s core primitives. A policy can say, for example, that an agent’s external communication requires human approval. When an AI requests that action, Kroy holds it, presents it to the right person with the details, and executes it only once approved. The request, the decision and the approver are recorded. Kroy enforces the rule at the point of action, not in a policy document nobody reads.