How do you put a human in the loop for actions that cannot be undone?

Sort the agent's tools by risk. Let it run reads and reversible actions freely, and make it pause before anything that cannot be undone: sending, paying, deleting, deploying. A person sees exactly what will happen and approves, edits or rejects it. The check must sit in code that runs before the tool, not in the prompt, so the model cannot talk its way past it.

1. Classify actions

2. Put the gate in code

• Claude Agent SDK. Set allow, ask and deny rules and a permission mode. The canUseTool callback fires for tools that are not approved in advance. It can allow (optionally with a changed input, such as a corrected recipient), or deny with a message Claude reads and adapts to. It does not fire for tools that are already allowed, so a check that must see every call belongs in a PreToolUse hook.
• LangGraph. interrupt() inside a node pauses the graph and saves its state with a checkpointer. The application shows the pending action, and Command(resume=...) continues from the same point, minutes or days later.
• Your own loop. When the model returns a risky tool_use, do not execute it. Store it, ask a person, and send back a tool_result that says approved and done, or rejected and why.

3. Show the person the right thing

• The exact action and its input: "Send to 4,210 customers, subject '…', body below".
• Why the agent wants to do it, and what happens if they say no.
• Edit as well as approve or reject. Fixing one field is better than a full restart.

4. Ask the model to ask

Give the agent a way to ask a question when it is unsure, such as the Agent SDK's AskUserQuestion tool, instead of guessing.

5. Avoid approval fatigue

If people approve 200 prompts a day, they stop reading. Batch low-risk changes into one review at the end, auto-approve what is safe, and keep the prompts for the few actions that matter. Log every decision with who made it.

Why it matters

OWASP lists human approval for high-risk actions among the main defences against prompt injection. Even a fooled agent cannot complete the damaging step on its own. That is the point of human in the loop.