Human approval design patterns
Calibrating where humans intervene is a design problem, not a policy problem.
Why every approval design is wrong at first
Every team that ships agentic systems eventually faces the same dilemma: approve everything, and you destroy most of the value the agent was supposed to deliver; approve nothing, and you fail your first compliance review. The first design is almost always wrong because it's set by policy reflex — 'just have a human in the loop' — rather than by thoughtful design.
The right framing is that approvals are a UX problem, a risk-calibration problem, and a learning problem at the same time. Here are the patterns we use most.
Pick the one that fits the risk shape
Each pattern fits a different risk-calibration curve. Most production systems use two or three.
Threshold-gated
The agent acts autonomously below a confidence or risk threshold and escalates above it. Threshold is per task class. Works for high-volume, well-defined work like claims under $5k.
Sample-audited
Agent acts autonomously; a sample of decisions is reviewed asynchronously for quality and recalibration. Works when individual decisions are low-stakes but aggregate behaviour matters.
Suggest-and-approve
The agent prepares the action and routes it for human approval before executing. Works for high-stakes irreversible work like large credits or trade overrides.
Override-on-demand
The agent acts; the user can override or undo. Works for reversible, customer-facing actions where speed matters more than perfection.
The cross-cutting concerns
These show up in every pattern, and most early designs miss them.
- Approvers see context-rich requests — the agent's reasoning, the alternatives considered, and the downstream effect — not just the proposed action.
- Approval routing respects on-call rotations, delegations and SLAs — the right person, not the loudest channel.
- Approval and override patterns feed back to recalibrate thresholds — the system should ask fewer trivial questions over time.
- Every decision (auto-act, escalate, approve, override, deny) is captured with timestamps and attribution.
- Approval can happen in the channel the human already uses — Slack, Teams, email, mobile push — not just an in-platform inbox.
Calibration is iterative
No production approval design works correctly on day one. Thresholds drift, approver fatigue sets in, business priorities shift. The right operational discipline is to review approval and override patterns quarterly and re-tune — the same way you'd tune any other production system. Treat it as ops work, not a one-time policy decision.
Ready to put autonomous agents to work?
See xyner in your environment with a guided executive demo.