An AI agent prepares a supplier payment. It matches the invoice to a supplier, checks the amount against a contract, and confirms that the payment date falls within the permitted window. Then it reviews its own checklist, marks the payment approved, and sends it.
The danger is not that an agent can never review its work. A review pass may catch omissions or formatting errors. The danger is treating that pass as independent authority when it relies on the same evidence, assumptions, and system that produced the action.
For consequential actions, an agent should not be the sole authority that approves its own work. It may propose an action, check it, and operate within limits delegated in advance. Authorization should come from a separate policy boundary or an accountable reviewer.
A review pass is not an approval boundary
A review asks whether an output appears correct. Approval authorizes a transition: a payment is sent, access is granted, a record is changed, or a commitment is made.
Those steps need different controls. An agent may check that an amount is numeric, that required fields are present, or that a policy rule appears to match. But if it linked the invoice to the wrong supplier, its later checks may all rely on that same mistaken identity. A second pass through the same context may repeat the error.
Changing the agent’s role label from “executor” to “reviewer” does not create independence. A meaningful approval boundary requires a separate source of authority, evidence, or control that can reject the proposed action.
Self-critique can help without granting authority
An agent can be asked to inspect its reasoning, test a plan, or search for contradictions. These checks can be useful, especially for defects that are easy to specify and detect.
They should not be treated as proof that the result is safe to execute. In an ICLR 2024 study, Huang and colleagues examined intrinsic self-correction: a model trying to correct its reasoning without external feedback. On the reasoning tasks they tested, models struggled to correct themselves reliably, and performance sometimes degraded after a self-correction attempt. The study does not evaluate complete agent approval workflows, but it cautions against treating a model’s own re-evaluation as independent validation. (Huang et al., ICLR 2024)
A verifier can add value when it checks something distinct: a deterministic calculation, an authoritative record, a permission boundary, or a separately maintained policy. The key property is what it can independently establish, not whether it is called a verifier.
Human involvement needs a real role
A human approval step does not automatically make a workflow safe. Reviewers can defer to system recommendations, work from incomplete information, or lack the authority and time to challenge an action.
NIST’s 2023 AI Risk Management Framework 1.0 says that roles and responsibilities in human-AI decision-making and oversight need to be clearly defined and differentiated. It also recognizes that AI systems may operate autonomously in some contexts while others specifically require human oversight. (NIST AI RMF 1.0, Appendix C)
A 2025 European Commission Joint Research Centre study examined human oversight in lending and hiring scenarios with 1,411 HR and banking professionals in Italy and Germany. In those scenarios, participants were equally likely to follow advice from a generic AI described as discriminatory as advice from an AI programmed to be fair. The report concluded that human oversight did not prevent discrimination when the generic AI was used. This study is specific to its scenarios; it shows why a human sign-off label alone cannot guarantee effective oversight. (Gaudeul et al., Joint Research Centre, 2025)
An effective reviewer needs the information and authority to make a decision: the action being proposed, relevant evidence and its sources, applicable constraints, material uncertainty, likely effects, and a practical way to reject, revise, or request more information.
Design the authorization boundary
A governed agent workflow can separate proposal, validation, authorization, and execution:
- Propose. The agent submits a specific action with its supporting evidence, assumptions, and expected effects.
- Validate. Independent checks verify the target, permissions, amounts, policy constraints, and current state using suitable sources or deterministic tools.
- Route by risk. A policy determines whether the action is within pre-authorized limits, needs human approval, or must be blocked or escalated.
- Authorize. A separate authority approves the exact action. The agent cannot grant itself the permission needed to approve or execute it.
- Execute and record. The system executes only the authorized action and records what was checked, approved, and carried out.
Approval should be tied to the action and relevant state that were actually reviewed. If the target, amount, policy version, or other material input changes, the approval should no longer apply.
The approval gate must be enforced where the action is executed. A prompt instruction such as “ask for approval first” is not enough if the agent’s tools still allow it to bypass that step.
Autonomy should be delegated in advance
Not every agent action needs an individual human sign-off. Low-impact, reversible actions may be handled automatically when an organization has explicitly allowed them within defined limits and the system can enforce those limits.
The distinction is where the authority comes from. A policy may pre-authorize a narrow class of actions. The agent should not decide for itself, after preparing an action, that the action deserves approval.
As impact, uncertainty, irreversibility, or scope increases, the workflow should require stronger checks and a clearer authorization path. If evidence is missing, the action falls outside policy, or the effect cannot be reliably bounded, the system should pause, abstain, or escalate.
Evaluate whether approval works
Approval design should be evaluated against realistic failure cases, not just whether a reviewer can click “approve.”
Useful measures include unauthorized actions, missed policy violations, false approvals, inappropriate blocks, reviewer corrections, time to resolve escalations, and whether approved actions match the versions of the evidence and state that were reviewed. Test whether reviewers detect seeded errors and whether the agent can reach an execution path that bypasses the gate.
The goal is not to maximize the number of approvals or insert a human into every step. It is to make authority explicit, proportional to risk, and enforceable.
Separate the agent’s work from its authority
AI agents can prepare work, inspect it, explain it, and execute actions within limits that have been explicitly delegated. For consequential actions, they should not be the only authority that decides their own work is ready.
A review pass can be useful. A governed system needs more: independent checks, a clear authorization boundary, and an accountable way to stop or change the action.
An agent may recommend what should happen. It should not be able to turn its own recommendation into consequential action solely by approving itself.
References
- Huang, J. et al. “Large Language Models Cannot Self-Correct Reasoning Yet.” International Conference on Learning Representations (ICLR 2024). Paper.
- National Institute of Standards and Technology. “AI Risk Management Framework 1.0, Appendix C: AI Risk Management and Human-AI Interaction.” 2023. Framework appendix.
- Gaudeul, A. et al. “The Impact of Human-AI Interaction on Discrimination: A large case study on human oversight of AI-based decision support systems in lending and hiring scenarios.” European Commission Joint Research Centre, 2025. Report record.