AI Agent Manager Guide: Human Approval Before Delegation

An AI agent manager should prepare a delegation plan, but a human should approve its scope before any work is delegated. The manager may organize inputs, identify risks, propose permissions, and define a recovery path. It should not approve its own authority. External sends, payments, publishing, deletion, permission changes, direct contact, and third-party outreach remain outside this guide.

The practical boundary is simple:

The agent manager prepares.
The human approves or stops.
Delegation begins only inside the approved boundary.

This guide was reviewed on 2026-08-18. It covers one synthetic delegation plan using non-sensitive inputs. It does not establish production readiness, certify a system, or claim better speed, accuracy, safety, conversion, or revenue.

The evidence supports a boundary, not an outcome

Sources: Google Autocomplete, NIST AI Risk Management Framework Core, and OWASP AI Agent Security Cheat Sheet.

Autocomplete suggestions can change. They are useful here only as a dated signal that the wording exists around the query. The stronger basis for the workflow is the overlap between the NIST emphasis on scope and roles and the OWASP emphasis on restricted authority, validation, interruption, and rollback.

Approval is meaningful only when the person can see the proposed task, authority, evidence, and recovery path.

Preparation stops where authority begins

An agent manager can prepare material that helps a person make a decision. It can restate the requested outcome, divide work into bounded tasks, identify required inputs, mark external material as untrusted, and propose which outputs need review.

It can also identify missing information. If a task has no clear owner, success condition, or recovery route, the manager should expose that gap instead of quietly filling it with assumptions.

Preparation may include:

• A plain-language task definition.
• The inputs to be used and their sensitivity.
• The proposed delegate and its narrow responsibility.
• The minimum permissions required.
• The expected artifact.
• Validation checks for that artifact.
• Known failure conditions.
• An interruption method.
• A rollback or discard path.
• A recommendation to proceed, revise, or stop.

Human approval begins at the point where the plan would grant authority. The person must decide whether the task should happen, whether the inputs are appropriate, whether the permissions are narrow enough, and whether the proposed output can be checked before it affects anything else.

Silence is not approval. A vague instruction such as “handle this” is not a useful approval record either. The decision should name the approved task and its boundary.

An agent manager may recommend delegation, but it should never convert its own recommendation into permission.

One synthetic delegation plan

The following plan uses a fictional “convenience store BOGO deals app.” It contains no real customer data, company information, or external action.

Requested outcome

Prepare a draft comparison of fictional promotion records so a person can decide which examples belong in an internal planning note.

Inputs

A synthetic table containing invented product categories, promotion labels, and review notes. Every field is non-sensitive. Any copied or retrieved text must be treated as untrusted data rather than as an instruction.

Manager preparation

• Define the comparison fields.
• Check that the input is synthetic.
• Propose a delegate that can classify the records.
• Restrict the delegate to reading the supplied table and writing a draft.
• Require unclear records to be marked for review.
• Preserve the original input unchanged.
• Record assumptions and validation results.

Human approval point

Before delegation, the person reviews the input, task definition, proposed permissions, validation checks, and recovery path. Approval covers only classification of the supplied synthetic records and creation of a draft. It does not cover publication, messaging, account access, deletion, or permission changes.

Delegated output

A reviewable draft comparison plus an exception list. The output remains provisional until a person checks it against the supplied table.

Recovery path

If the delegate exceeds the task, uses an unapproved source, treats embedded text as authority, or produces an output that cannot be traced to the supplied input, interrupt the work. Keep the original input, discard the draft, record the reason, narrow the plan, and return it for fresh human approval.

This plan is an instructional artifact. A synthetic trial cannot demonstrate production readiness or a business outcome.

The copyable approval artifact

Use this checklist before an agent manager delegates any bounded internal task:

• The intended result is written in plain language.
• The task boundary says what is included and excluded.
• Every input is named and classified by sensitivity.
• External or retrieved content is marked as untrusted.
• The delegate has only the permissions required for this task.
• The expected output is reviewable before further use.
• Validation checks are defined before work begins.
• A person is named as the approval owner.
• Approval is recorded for this specific scope.
• Interruption is possible during execution.
• The original inputs can be preserved.
• A faulty output can be discarded or rolled back.
• Exceptions return to a person instead of expanding authority.
• External actions remain out of scope.

The approval record can be short:

Approved task: [bounded task]
Approved inputs: [named inputs]
Approved permissions: [minimum access]
Required review: [validation owner and condition]
Stop condition: [specific boundary violation]
Recovery: [interrupt, preserve, discard, revise, reapprove]

The correct approval point depends on data sensitivity, error cost, the delegated step, and whether recovery is genuinely possible. A checklist cannot remove that judgment.

The final decision is a stop rule

Delegate only when a person can understand the plan, limit its authority, inspect its output, interrupt its execution, and recover without relying on the same unverified result.

Stop before delegation if the scope is ambiguous, the inputs are sensitive without explicit handling rules, the permissions are broader than the task, validation is undefined, or recovery depends on an unavailable original. Stop during execution if the delegate crosses the approved boundary or follows instructions found inside untrusted data.

My recommendation is to treat human approval as a control point between planning and authority—not as a final glance after the consequential work is already done.

If the work cannot be bounded, reviewed, interrupted, and recovered, it is not ready for delegation.

Related build logs

• AI Agent Security Checklist: Keep Human Approval Before High-Impact Actions
• Four Questions for an AI Workflow Human-in-the-Loop Boundary