AI agents and the actions a person must approve

01From drafting text to taking actions

A conversational assistant writes a draft and stops; someone else decides what happens next. An agent is given tools. It can amend a customer record, reserve an appointment, assign a case, email a supplier or queue a payment for release. Once software acts on your systems, the quality of a reply is no longer the main concern. The concern becomes accountability: which officer agreed to this action, and at what moment?

Security practitioners already have a label for agents that are allowed too much. OWASP’s list of the main risks for applications built on large language models includes excessive agency (opens external site), which it describes in terms of more functions, more permissions or more independence than the task calls for. Approval by a person is one remedy, and it has a price. Required at every step, it slows the work and teaches reviewers to click through. Required nowhere, it leaves actions that nobody in fact decided. Placing it well is the real task.

02Begin with an inventory of tool calls

List every tool the agent is able to call, then put four questions to each one. The questions concern the action and its consequences. The model behind the agent does not feature in them.

1. 01How hard is it to reverse? A second click, a corrected letter, a refund to a customer, or proceedings in court.
2. 02Whom does it reach? A colleague, an internal draft, a customer, a member of the public, a sum of money or an outside party.
3. 03Does it bind the organisation? A decision about an individual, a payment, a contractual commitment or a message issued under your name.
4. 04At what volume and speed? A step repeated thousands of times daily calls for another kind of control than one used twice a week.

The answers sort each tool call into one of four tiers. In most organisations a small number of actions account for nearly all of the exposure. That is useful to know, because approval effort can then be concentrated where it matters.

These tiers are an engineering device, not a legal category, so test them against the rules your organisation is subject to. For an organisation in Malaysia, that starts with the Personal Data Protection Act 2010 (Act 709), the PDPA, as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727). Malaysia’s National Guidelines on AI Governance and Ethics (AIGE) are voluntary guidance, not law; the binding rules for an agent that handles personal data come from the PDPA.

EU law can apply as well. Under Article 22, the EU General Data Protection Regulation (GDPR) gives individuals rights where a decision rests solely on automated processing (opens external site) and affects them legally or in a comparably serious way. Under Article 14 of the EU AI Act, high-risk systems must be built so that people can oversee them effectively (opens external site). Those duties usually fall on tier 4.

03Conditions that always go to a person

Certain conditions should lift an action into a higher tier, whatever tier it normally sits in. Build them into the workflow as explicit rules, so that escalation never depends on the agent spotting the problem itself.

• The input is unlike anything the agent was tested with: an unfamiliar document type, a language it was not evaluated in, or fields that are missing or contradict each other.
• The retrieved sources disagree, or the proposal depends on a statement the agent cannot cite.
• The amount, the scope or the number of records affected exceeds a limit you have set.
• The case involves sensitive personal data as the PDPA defines it, such as health or biometric data, or concerns a minor, a complaint, a pending appeal or a dispute.
• A retry has already happened, or a system further down the chain has returned an error.

What the model says about its own confidence is left off that list on purpose. Language models can phrase errors persuasively, which NIST, the United States standards body, describes as confabulation (opens external site) in its profile of generative AI risks. A score the model reports about itself may count as one signal. It belongs beside independent checks, for example a comparison against the system of record and validation rules, and never in their place.

04An approval step a reviewer can genuinely use

A steady flow of “approve?” prompts produces reviewers who approve by habit. The AI Act names this tendency directly: people who oversee a high-risk AI system have to remain alert to automation bias.

Four design decisions turn that requirement into daily practice.

Present the evidence with the proposal

Set out the proposal in plain language. List the sources behind it, each linked so that it opens on the relevant passage, and name the policy or rule applied. State precisely what will change and in which system. When checking a proposal means opening three applications, a busy reviewer will sooner or later stop checking.

Make refusing as quick as agreeing

Rejection and amendment are ordinary results, not failures. Place them beside the approve button, ask for a brief reason with each rejection, and use those reasons when you evaluate the agent. If correcting a proposal takes longer than writing one from the start, reviewers will accept proposals that are not quite right.

Assign approval to an accountable officer

Approval should sit with a named role that has the competence, the training and the power to override the system. Deployers of high-risk systems are expected by the AI Act to organise oversight in this way (Article 26(2) (opens external site)). Appoint a deputy, define an escalation route and track how long items wait. An approval queue without an owner becomes the bottleneck that tempts teams to go around the gate.

Group only genuinely low-risk items

Checking forty almost identical items one at a time does not sharpen anyone’s attention. Tier 2 actions can be reviewed in batches, with random samples taken for a closer look. Items in tiers 3 and 4 are always reviewed individually.

05Enforce the gate where the action runs, not in the prompt

A line in a prompt does not control access. Content the agent processes, whether an email, an attachment or a website, can carry instructions of its own; OWASP calls this prompt injection (opens external site). If a sentence in the agent’s instructions is the only barrier before an irreversible step, plan for the day it is overridden.

• Give the agent a separate identity with the minimum privileges each tool requires, and let it act within the rights of the requesting user where the platform allows.
• Enforce approval where the integration runs: the service issuing the letter refuses any call that lacks a matching approval record for that exact action.
• Set limits on value, volume and frequency at the tool itself, independent of the agent.
• Separate the tools that read from the tools that write, so that the agent’s view can widen without its powers widening too.

06Personal data in prompts and tool calls

An agent that works with customer or employee records processes personal data at every step: in the prompt, in what it retrieves and in what it hands to a tool. Under the PDPA, personal data in a commercial transaction is processed with the data subject’s consent, subject to the exceptions in section 6(2). The written notice you give data subjects states the purposes of processing and the classes of third parties that receive the data.

Before an agent goes live, check that its use of personal data falls within the purposes your notice already states, or update the notice first. Sensitive personal data, which includes biometric data since 1 April 2025, needs explicit consent under section 40. An external model or search service that the agent calls on your behalf acts as a data processor, and since 1 April 2025 processors are bound by the Security Principle too. Put that in the contract.

07Record what you will later need to explain

For each run of the agent, store the request, the sources retrieved, every tool call and the parameters passed, the proposal, who approved, what was decided, any amendments, and when. Deployers of high-risk AI systems keep the logs the system generates automatically for six months at a minimum, unless other law says otherwise (Article 26(6) (opens external site)). Keep them even when no rule asks for them: they are how you learn what the agent does.

The same records serve the PDPA. Since 1 June 2025, a data controller that has reason to believe a personal data breach has occurred must notify the Personal Data Protection Commissioner as soon as practicable (section 12B), which under the Commissioner’s guidance means within 72 hours. Affected data subjects are told as well where significant harm is likely. An agent with access to personal data is one more place a breach can begin. Records of which data it read, which tools it called and under whose identity let you establish the extent of an incident within that window.

Read the records on a fixed schedule. Actions approved without change, time after time, are candidates for a lower tier. Actions that reviewers often amend reveal a weak spot in the agent or a tier set too low. Rejections concentrated on a single source, form or team usually expose a process issue that no model will solve.

08Begin cautiously, then lower tiers on evidence

Start with every action that carries real consequences in tier 3 or tier 4. Agree in advance what a good result is: which results are correct, which mistakes are acceptable and which are not. Then measure the agent against them; the Measure function in NIST’s AI Risk Management Framework (opens external site) serves well as a checklist.

Lower an action’s tier only on evidence: a stretch of time in which approved proposals needed no material change, tests built from the failures, and the agreement of the process owner. Log the decision like any system change, and keep the option to move the action back.

AI output will sometimes be wrong. That does not argue for keeping agents out of real work. It argues for deciding deliberately which decisions stay with people. Agents are valuable because they act, and well-placed approval gates are what allow you to entrust them with more over time.