Define a set of high-stakes action categories that require explicit human approval before the agent executes them — regardless of how the agent arrived at that decision. These should include: sending data outside the organization, modifying financial records or payment routing, changing access controls or permissions, deleting or overwriting data, and any action the agent has never performed before in this context.

The approval request must be delivered out-of-band — through a separate channel the agent cannot influence. An agent that can also write to the approval channel can approve its own actions. That defeats the entire control.

Present the approval request as a plain-language summary of what the agent wants to do and why — not a raw system log. The approver should be able to understand the action without security expertise. Include the source that triggered the action (the email, document, or input that led here) so the approver can recognize if it looks suspicious. Perplexity's post-disclosure response to PerplexedBrowser included exactly this: stricter user confirmation dialogs for sensitive actions.

Human approval is only as good as the human reviewing it. Approvers suffer from alert fatigue, rubber-stamp familiar-looking requests, and can be socially engineered via the approval UI itself. This mitigation works best for genuinely rare, high-stakes actions — not as a blanket control on everything the agent does.