---
title: Add human approval before your agent takes action
description: Add a review step to an existing AI SDK tool, with explicit approval, server authorization, and protection against repeated actions.
url: "https://vercel.com/kb/prompts/add-human-approval-to-agent-actions"
last_updated: 2026-11-07
related_resources:
  "[AI SDK tool calling](https://ai-sdk.dev/docs/ai-sdk-core/tools-and-tool-calling)": "Understand tool execution, approval requests, and provider-executed tool limits."
  "[Chatbot tool approval UI](https://ai-sdk.dev/docs/ai-sdk-ui/chatbot-tool-usage)": "Connect approval decisions to the chat UI and review integrity protection."
---

# Add human approval before your agent takes action

Add a review step to an existing AI SDK tool, with explicit approval, server authorization, and protection against repeated actions.

Let people review an agent’s proposed action before it changes something. This prompt adds approval to one existing tool, including the UI and the server checks that enforce the decision.

Open or import the app containing your agent and identify the action that needs approval. The handoff carries prompt text, not your repository, account access, or credentials. Use a test account or a local substitute for the action.

Expect clear approval and denial states, a reviewable action summary, and tests for tampering and repeated requests. A confirmation button alone does not establish authorization.

## Agent prompt

```text
Add human approval before one existing agent tool performs an action with external consequences. Implement the review UI and enforce the decision on the server.

Read repository instructions, then inspect the agent, authentication, tool execution, persistence, package manager, and installed AI SDK version. If the intended repository is missing, ask me to open or import it. Identify one tool to protect; ask if the intended action is ambiguous. Verify the approval APIs supported by the installed SDK using its documentation. Keep the existing stack and avoid an unrelated agent rewrite. If required storage or secrets are unavailable, keep execution disabled and use a local fake while documenting setup.

Before execution, show the proposed action, affected resource, and meaningful arguments in the existing UI. Provide separate Approve and Deny controls with keyboard support and visible pending, denied, completed, and failed states. Never treat model text, a retrieved document, or a client-supplied “approved” field as authorization.

Bind each pending approval to the authenticated user or tenant, conversation, tool call, exact validated arguments, and an expiration. Persist authoritative state on the server using existing storage. Verify ownership and current permissions again when executing. Reject altered, expired, unknown, or already-consumed approval requests. Use the SDK’s documented integrity protection where supported, but retain application authorization and replay protection. Cover the real execution boundary; provider-executed tools may require a different control and must not bypass this gate.

A changed action or arguments requires a new review. Denial must perform no action and must not cause an automatic repeated approval request. Handle concurrent approval submissions with an atomic state transition. For external writes, use a stable operation identifier and the destination’s idempotency support. If a timeout leaves the outcome unknown, expose a reconciliation state rather than blindly retrying the action.

Test with a local fake executor: approval runs the reviewed action; denial runs nothing; altered arguments, another user, expiry, and replay are rejected; concurrent submissions do not duplicate effects. Simulate success followed by a lost response, and show how the user can recover without guessing whether it ran.

Proceed with reversible local changes. Ask before executing real actions, sending messages, spending money, or deploying. Report what changed, checks and results, blocked checks, required secrets/configuration, local run steps, and any unresolved integrity or recovery limitations.
```

## Related resources

- [AI SDK tool calling](https://ai-sdk.dev/docs/ai-sdk-core/tools-and-tool-calling): Understand tool execution, approval requests, and provider-executed tool limits.

- [Chatbot tool approval UI](https://ai-sdk.dev/docs/ai-sdk-ui/chatbot-tool-usage): Connect approval decisions to the chat UI and review integrity protection.

## Try other prompts

- [Add a tool to an existing agent](/kb/prompts/add-agent-tool): Extend your agent with one focused tool, including validated inputs, server-side permissions, and tests for service failures.

- [Add resumable background workflows to your app](/kb/prompts/add-resumable-background-workflows): Move an existing background job into Workflow steps, with bounded retries, visible progress, and protection against duplicate effects.

## Reference Architecture

Choose a stack and work through the decisions behind it, with curated documentation, guides, templates, and courses to help you build.

- [Agent stack](/kb/architecture/agents): Build and operate agents with models, tools, and durable workflows.
- [Web applications](/kb/architecture/web): Choose rendering, data, authentication, and caching approaches.
- [Backends](/kb/architecture/backends): Choose a runtime, connect services, and run background work.

[Browse all stacks](/kb/architecture)

## Build with prompts

Build an app, extend an agent, or improve your project with ready-to-use prompts for your coding agent.

[Browse the prompt library](/kb/prompts) · [Read the Markdown index](/kb/prompts.md)