---
title: "Ask a person before the agent spends or · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/human-approval
updated: 2026-10-20
licence: "All rights reserved"
---

# Ask a person before the agent spends or deletes

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [AI agents and models](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models)
- Rule: Require a clear yes from the user before the agent pays, sends a message, deletes data or changes an account.
- How: Have these tools return a draft instead of acting. Show the user exactly what will happen, then act only on their confirmation, outside the model. The confirmation must come from the user's click, not from text the model writes.
- Check: Through an injected page, ask the agent to delete a test record. The record is still there, and the user saw an approval request.

Example:

```js
async function refundOrder({ orderId, amount }, user) {
  const draft = { action: 'refund', orderId, amount };
  return { needsApproval: true, approvalId: await saveDraft(draft, user) };
}
```

```python
def refund_order(order_id: str, amount: int, user) -> dict:
    draft = {"action": "refund", "order_id": order_id, "amount": amount}
    return {"needs_approval": True, "approval_id": save_draft(draft, user)}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/human-approval`.

- Previous: [Give agent tools the least power they need](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/least-privilege-tools)
- Next: [Treat model output as untrusted](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/untrusted-model-output)
- [AI agents and models](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models)