Define a set of high-privilege or irreversible actions that require explicit human approval before the agent can execute them. Examples: creating new user accounts with elevated roles, transferring funds above a threshold, deleting production data, modifying access control lists, issuing certificates, making outbound connections to new external endpoints.

When an agent attempts one of these actions, it must pause, surface the proposed action to a human approver with enough context to make a real decision, and wait for explicit approval before proceeding.

Acts as a catch-all for escalation attacks that automated controls missed. Scenario 02 (memory-based escalation — agent tries to set up SSH access for an unauthorized user) would be stopped here: "Create SSH admin access for user X" triggers a human approval step. Scenario 03 (cross-agent trust — fraudulent payment instruction) would surface the payment to a human before execution.

Human-in-the-loop reduces the speed benefit of agentic automation. The scope must be well-defined — too broad and the agent becomes as slow as manual processes; too narrow and the safety net has holes. Focus on: actions that are hard to reverse, actions that grant persistent access to others, and actions above a defined monetary or data exposure threshold.

Human approval only works if the approver has real context. Show them the original user's identity, the action being requested, the credential being used, and why the agent thinks it's authorized. An approval dialog that shows only "Agent wants to perform action: yes/no" provides no real safety — approvers will click yes without reading.