Impri: A Structural Human Approval Gateway for AI Agents

The "Last Mile" Trust Problem in AI Agents

With the rise of frameworks like LangChain and LangGraph, building AI agents capable of executing tasks autonomously has become increasingly straightforward. LangChain is one of the most popular AI agent development frameworks — open-sourced in late 2022 — providing standardized abstractions for tool calling, memory management, and chain-of-thought reasoning. LangGraph, an extension within the same ecosystem, is designed specifically for complex multi-step workflows. Built on a directed acyclic graph (DAG) model, it represents agent execution as a state machine, where each node is an execution step and each edge is a state transition condition, enabling complex branching, loops, and parallel execution.

But a pressing question has emerged: when an agent is truly ready to "act" — sending emails, calling state-mutating APIs, publishing content — can we really trust it to run fully autonomously?

A developer shared a recurring frustration on Reddit: writing "please confirm first" in a prompt is simply not enough, because an LLM can reason its way around such soft instructions. A model's autonomy is precisely what makes it valuable — but it also means prompt-based constraints alone cannot establish reliable safety boundaries. To address this, he built a human approval gateway called Impri.

Why Prompt-Level Constraints Are Unreliable

This is the core insight behind the entire project. Many current agent "safety mechanisms" are written directly into the system prompt: "Please confirm with the user before executing sensitive operations." But this kind of constraint is advisory, not enforced.

From a technical standpoint, LLM reasoning is fundamentally probabilistic token prediction. Instructions in the System Prompt are encoded as part of the attention weights, but they carry no semantic equivalent of a "hard interrupt" in programming languages. In long chain-of-thought reasoning, a model's goal-oriented behavior can override soft constraints — a phenomenon researchers call "goal misgeneralization." Jailbreak research has further demonstrated that even carefully designed safety prompts have systematic bypass paths.

In complex reasoning chains, an LLM can skip confirmation steps and invoke tools directly due to context pressure, goal-directedness, or hallucination. In other words, prompt-level control delegates safety responsibility to an inherently non-deterministic system. For operations involving money, identity, or external state changes, this level of risk is simply unacceptable.

Impri's Core Design: A Structural Gate, Not a Prompt-Layer Constraint

Impri's most critical principle is that it is a structural gate, not a prompt-layer constraint. The author repeatedly emphasizes: "The tool cannot touch the real function until it has seen an approved decision from the API."

This means the approval logic is embedded directly in the code execution path — not delegated to the model's judgment. Regardless of how the model reasons, if no human approval signal has been received, the real function will not be called. This is a defense-in-depth approach enforced at the architectural level.

Two Integration Modes

Impri offers two integration paths for the LangChain ecosystem:

The first is ImpriApprovalTool, a subclass of BaseTool that can be added directly to an agent's toolset. It also provides a wrap() factory function that can turn any existing tool into a version requiring human approval. This design is particularly friendly to existing projects — no need to rewrite tools; simply wrap them with wrap().

The second is an interrupt-style mode for LangGraph. LangGraph natively supports execution pausing via the interrupt() primitive, and when combined with persistent state storage (such as Redis or PostgreSQL), it enables cross-process checkpoint resumption. Impri's workflow aligns naturally with this: push a pending approval action, store the action ID in the graph state, pause execution, and resume from the breakpoint once the human decision returns. This mirrors LangGraph's native human-in-the-loop interrupt mechanism and integrates naturally into the state graph execution model.

The Approval Workflow in Detail

When an agent triggers a controlled operation, Impri opens an approval_gate context manager that blocks execution until a human responds through one of the following channels:

• Web-based approval inbox
• Slack
• Discord
• Telegram

It's worth noting that reviewers aren't limited to simply "approve" or "reject" — they can also choose to edit, modifying the action parameters before allowing execution to proceed. This is highly practical in real-world scenarios, such as when an agent drafts an email that needs minor human adjustments before sending.

Deployment and Open Source Strategy

Impri follows a dual-track model: open source plus managed hosting. This "Open Core" strategy has been well-validated in the developer tools space — projects like GitLab, HashiCorp (Terraform), and Airbyte have all taken similar paths. Open sourcing lowers the barrier to adoption, builds community trust, and attracts contributions, while the managed service converts operational complexity into willingness to pay.

• Open core: The core codebase is MIT-licensed, allowing commercial use and modification.
• Self-hostable: Deployable via Docker Compose, suited for teams with strict data and process control requirements. For security infrastructure tools in particular, self-hosting capability is critical — enterprise customers often cannot send sensitive operation approval logs to third parties due to data sovereignty or compliance requirements.
• Managed cloud service: Offers a free tier with no credit card required, significantly lowering the barrier to getting started.

Human-in-the-Loop: The Balance Between Autonomy and Controllability

Human-in-the-Loop (HITL) is not a new concept in the AI era — it has been well-established in active learning and reinforcement learning from human feedback (RLHF). In the context of agent engineering, HITL refers specifically to an architectural pattern that preserves human decision-making authority at critical nodes in an automated workflow.

What Impri addresses is one of the core pain points in deploying agents today: how to strike a balance between autonomy and controllability. Fully autonomous agents are highly efficient in low-risk scenarios (information retrieval, data analysis, content drafting), but once irreversible external actions are involved, human confirmation becomes a necessary safeguard. The industry consensus is: let agents handle the heavy lifting of reasoning and execution, while preserving human veto power at key decision points.

Impri's value lies in productizing and standardizing this human-machine collaboration, rather than forcing every team to reinvent the wheel. The author openly acknowledged at the end of his post that the project is still in early stages, and actively solicited community feedback: "If you've built your own approval layer for LangChain/LangGraph agents, I'd love to hear how you did it."

Three Questions Worth Considering Before Deployment

For developers evaluating tools of this kind, the following aspects deserve close attention:

Latency and blocking. An approval gateway inherently blocks the agent's execution flow. For latency-sensitive or high-concurrency scenarios, timeout handling, batch approval, and async resumption mechanisms will directly determine practical usability.

Approval Fatigue. This issue is well-documented in information security literature, sharing the same category as "alert fatigue" — a cognitive overload problem. Research shows that when the frequency of security confirmation requests exceeds human decision bandwidth, operators shift into automatic decision mode, effectively reducing approvals to a formality. This phenomenon has been systematically exploited by attackers in multi-factor authentication (MFA) fatigue attacks — Uber's 2022 security incident is a textbook example. A sensible approach is to combine risk tiering with the zero-trust philosophy of "continuous verification, least privilege": require mandatory approval for high-risk actions while allowing configurable auto-approval for low-risk ones.

Audit and compliance. Structural gates naturally produce complete records of operational decisions. For enterprise scenarios with compliance auditing requirements, this is a meaningful added benefit.

Conclusion

Impri represents a pragmatic direction in the engineering of AI agents: rather than hoping models will "behave themselves" by instruction alone, establish hard, unskippable safety boundaries at the code level. As agents increasingly enter real business workflows, the importance of human-in-the-loop infrastructure like this will only continue to grow. For any team building agents that will truly "take action," Impri is a reference paradigm well worth studying in depth.