Designing approval rules for agents

Why do agents need approval rules at all?

Agents act faster than people can watch. Most of what they do is routine and should flow without interruption. A small set of actions is different: moving money, deleting records, changing access, sending messages outside the company. A mistake there is expensive or impossible to undo.

Approval rules separate the two. They send the risky few to a person and let the rest run. This is control GOV-07 in the register. It routes actions above a defined risk threshold to a named human approver and blocks them until that person approves.

Approval is also the clearest form of human oversight. The EU AI Act asks that people assigned oversight of a high-risk system can decide not to use it, or override or reverse its output. A named approval step is a direct way to do that for agents.

What is the allow, ask, deny model?

Most governance platforms use three outcomes for each action.

• Allow: the action runs and is logged.
• Ask: the action pauses until a named human approves or refuses.
• Deny: the action is blocked and the attempt is logged.

The art is in choosing which actions sit in ask. Too few, and oversight is thin. Too many, and approvers stop reading. Approval fatigue is real. A person who approves fifty requests an hour is not overseeing anything.

Which actions should need a human?

Start with a short list based on harm, not on tool names. Ask of each action: if an agent did this wrongly a thousand times, how bad would it be, and could we undo it?

Actions that usually belong in ask:

• Payments, refunds and any change to financial records.
• Deleting records or bulk updates beyond a set size.
• Exports above a record threshold.
• Changes to access rights, roles or group membership.
• Messages or emails sent outside the company.
• Deployments to production.

Actions that usually belong in deny:

• Calling tools outside the agent's allow-list (GOV-10).
• Approving its own pending action (GOV-08).
• Reaching data classes outside its purpose (GOV-22).

Everything else starts in allow, with logging. Review the logs after a month and move actions between outcomes based on what you see.

Who should approve?

The approver must be a named person, not a group inbox. In most cases it is the agent's owner or a role the owner names. Examples are the finance approver for payments or the security on-call for access changes.

Two rules protect the approval itself.

• No self-approval. An agent must never approve its own action, and the person who asked for an action must not be its only approver. In the register, NewCore documents that an agent can never approve its own action.
• Strong confirmation. The approver should confirm in a way that is hard to fake. NewCore routes risky calls to a named approver who confirms with device biometrics.

What should happen when nobody answers?

Every approval request needs a response window and a timeout outcome. The safe default is deny. A missing answer should never quietly become a yes.

Set windows by urgency. Fifteen minutes for payments and access changes. Thirty to sixty minutes for deletions and external messages. Tell requesters what happens on timeout, so they can resubmit or escalate.

How do you test approval rules before go-live?

An untested rule either blocks real work or misses risky calls. Control GOV-09 asks you to test new or changed policies against realistic or recorded activity before enforcing them.

Policy replay does this well. You run the new rule against recent sessions and see how many actions it would have allowed, sent for approval or denied. Look at three numbers. How many approvals per approver per day? If it is high, tighten the rule. How many denials of legitimate work? If any, fix the rule. And which past risky actions would now be caught?

NewCore documents writing policies in a sentence and replaying them against recent real sessions before going live. Few other platforms in the register describe pre-enforcement testing in public material.

How do the platforms compare on approval?

Approval is the area with the widest spread in the register, from two to ten. NewCore scores ten for named approvers, biometric confirmation and no self-approval. Silverfort scores nine for requiring approvals before sensitive tool actions, with step-up verdicts in its MCP Gateway. Cyera Identity escalates write operations in CRMs and scores six. Descope approves agents at onboarding but per-call approval was not found, also six.

Several platforms score two because human approval was not found in their public material. That does not mean they cannot do it. It means a buyer should ask for a demonstration.

What should the approval record contain?

Each approval is evidence. Log the request, the approver, the decision, the time and the reason if one was given (GOV-13). Include refusals and timeouts. Keep these records for the retention period in your policy (GOV-23).

Auditors will sample approvals. They will check that the approver was not the requester, that the approver had authority, and that the action ran only after approval. Make those three checks easy to answer from the log.

How do you keep the rules healthy?

Review the approval matrix every quarter with agent owners. Move actions that are always approved to allow with logging. Move actions that are often refused to deny. Add new tools as agents gain them, through change management (GOV-20).

Watch approver load. If any approver handles more than a few dozen requests a day, split the role or tighten the rule. Oversight that people cannot sustain will be bypassed.

What mistakes should you avoid?

Three mistakes recur. Teams route every write action to approval, which buries approvers within a week. They let timeouts allow the action, which turns silence into consent. And they forget to log refusals, which removes the evidence that oversight actually happened. Start narrow, deny on timeout and log every outcome.

Where to go next

The approval matrix template gives a starting list of actions with tiers, approvers, windows and timeout outcomes. The human oversight ranking reweights the register toward approval. The control pages for GOV-07 and GOV-08 show which platforms document each, with sources.