GOV-07: Human approval for high-risk actions
In short: Route actions above a defined risk threshold to a named human approver, and block them until that person approves. Some actions cannot be undone: payments, deletions, external messages. A human decision before execution is the clearest form of oversight regulators describe.
1GOV-07
What does GOV-07 require?
Route actions above a defined risk threshold to a named human approver, and block them until that person approves.
Why does it matter?
Some actions cannot be undone: payments, deletions, external messages. A human decision before execution is the clearest form of oversight regulators describe.
How do you test it?
- Trigger a high-risk action and confirm it waits for approval.
- Confirm the approver is a named person, not a group inbox.
- Check that a timeout denies the action instead of allowing it.
Which platforms document GOV-07?
Documented by NewCore and Silverfort.
- 9.10NewCore documentedSource: NewCore: Govern, read
- 8.35Silverfort documentedSource: Silverfort: AI Agent Security, read
- 7.30Cyera Identity partly documentedSource: Oasis Agentic Access Management, read
- 6.85Descope partly documentedSource: Descope Agentic Identity Hub 3.0, read
- 7.30Astrix Security not found in public materialChecked: Astrix at RSAC 2026; Astrix product; Cisco and Astrix Security, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 6.35Clutch Security not found in public materialChecked: Clutch Security platform, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
- EU AI ActArticle 14(4)(d): People assigned oversight must be able to decide not to use the system, or to disregard, override or reverse its output. Source: Regulation (EU) 2024/1689, the AI Act, on EUR-Lex
Which controls are related?
- GOV-06Per-action policy
- GOV-08No self-approval
- GOV-13Per-action audit log tied to a person
Glossary: allow ask deny, human in the loop, human oversight, risk tier, high-risk action, ai act.
Reviewed by The Register desk