withHuman: Building a Human Approval Layer for AI Agents

AI Agents are moving from demos to production environments, but a critical question remains unresolved: when an Agent autonomously calls tools and executes actions, who is the gatekeeper? withHuman's answer is to insert a human approval layer between the Agent and the real world, letting rules handle routine operations and letting humans handle risky ones.

Why AI Agents Need an Approval Layer

An Agent's core capability is autonomously calling tools—writing files, sending requests, modifying databases, executing commands. The stronger the capability, the higher the cost of a mistake. A misconfigured Agent could delete production data; a misjudged call could trigger an irreversible external action.

The traditional approach is to add constraints in the Prompt or give the Agent a fixed permission allowlist. But both paths have obvious shortcomings: Prompt constraints are unreliable—the model may "forget" instructions in a long context; and fixed allowlists are too rigid to adapt to dynamic tasks.

withHuman's entry point is direct: rather than trying to make the Agent "smarter," it intercepts tool calls before they actually execute. Routine calls are automatically allowed or denied by rules, while high-risk calls are pushed to the right person on the team for a decision. This is essentially giving the Agent a programmable approval middleware.

AI Agent refers to a large language model-driven system capable of autonomously perceiving its environment, making reasoning-based decisions, and calling external tools to execute tasks. Unlike traditional chatbots that can only generate text, Agents possess "action capability"—they can read and write files, call APIs, operate databases, execute Shell commands, and more. This autonomy comes from the tool calling (Tool Calling / Function Calling) mechanism of large models: the model decides on its own which tool to call and what parameters to pass based on the task goal.

Precisely because an Agent's output directly affects real systems, the cost of its errors is far higher than pure text generation. A single misjudgment could cause data deletion, fund transfers, service interruptions, and other irreversible consequences. The industry has therefore proposed the "Human-in-the-Loop" model, introducing human confirmation at key nodes in automated workflows. withHuman is precisely the productized implementation of this model at the Agent tool-calling stage, turning "human oversight" from an abstract principle into configurable approval middleware.

Core Mechanism: Intercept, Judge, Route

withHuman's workflow can be broken down into three steps.

Interception happens at the moment the Agent initiates a tool call. withHuman captures the request before the call actually reaches the target system, which means that even if the Agent "decides" to perform a dangerous operation, the actual operation will not occur without approval.

Judgment is performed by the rules engine. Teams can define which calls are routine operations that can be allowed directly, and which require human confirmation. There is one set of rules, but it applies to all Agents running within the company—this is the "One set of rules for every agent" that withHuman emphasizes.

Routing determines who approves. Risky calls are not thrown into an unattended queue, but sent to the corresponding owner on the team. This design breaks out of the "fully automated vs. fully manual" dichotomy, shifting to risk-tiered handling.

A rules engine is the decision-making core of the approval layer, typically composed of a set of conditional expressions that match and evaluate each tool call. Typical rule dimensions include: tool name (such as db.delete, file.write), parameter characteristics (such as whether the target path belongs to a production directory), call frequency, the identity of the initiating Agent, and more. Rules can be designed with three types of outcomes: allowlist, denylist, or require human confirmation.

Routing addresses the question of "who should the approval request be sent to." In enterprise scenarios, different operations correspond to different owners—data operations should be approved by the data team, code deployments should be confirmed by operations or R&D leads. Routing mechanisms typically distribute approval requests based on rule tags, team groupings, or on-call schedules, and can set timeout escalation policies to prevent requests from lingering. The separation of judgment and routing allows the same interception logic to be reused across multiple teams while keeping accountability clear.

Cross-Framework Compatibility: One Open Protocol Solves Fragmentation

The reality enterprises face is that the Agent tech stack is highly fragmented. Some use Claude Code, some use Codex, and some build their own Agents using LangGraph or Pydantic AI. If the approval layer can only adapt to one framework, its value is greatly diminished.

withHuman chooses to achieve cross-framework compatibility through an open protocol (AAP). The official description explicitly mentions support for Claude Code, Codex, and Agents built with LangGraph, Pydantic AI, and other approaches.

This protocol-first strategy has two layers of meaning. For developers, there is no need to rewrite Agent logic just to integrate the approval layer; for enterprises, one set of rules can cover all Agents, avoiding the operational burden of building a separate approval process for each framework.

An open protocol here refers to a standardized interface specification independent of any specific framework—any Agent framework that sends tool-call requests according to this specification can have them uniformly intercepted and processed by the approval layer. The AAP (Agent Approval Protocol) adopted by withHuman falls into this category.

Without an open protocol, approval functionality often requires separately developing adapters for each framework, creating M×N integration complexity (M frameworks × N approval systems). The protocol-first approach reduces this to M+N: frameworks implement the protocol client, and the approval layer implements the protocol server, decoupling the two sides. This aligns with the approach of standardization efforts such as MCP (Model Context Protocol)—reducing the integration costs caused by ecosystem fragmentation through agreed-upon interfaces, and enabling enterprise security policies to be uniformly enforced across tech stacks.

Open Source + Hosted: Two Deployment Paths

withHuman adopts a combination of open source plus a hosted version. The open source version lets teams deploy on their own, audit the code, and customize as needed—especially important for security-sensitive teams, since the approval layer itself is a trust node. The hosted version lowers the barrier to entry, suitable for teams that do not want to maintain infrastructure themselves.

The product received 80 votes and ranked 7th on Product Hunt, categorized under Open Source, Developer Tools, and Artificial Intelligence. The maker also provided a PRODUCTHUNT discount code for three months of free use of the Scale version.

Where the Boundaries of the Approval Layer Lie

withHuman solves a specific link in the safe deployment of Agents, but it also raises some questions worth considering. How should the granularity of approval rules be determined? If the rules are too loose, the approval layer becomes a mere formality; if the rules are too tight, the Agent's automation value is dragged down by manual approvals. In addition, when multiple Agents concurrently execute a large number of tool calls, whether the approval queue's processing efficiency can keep up is also a practical challenge.

Another dimension worth attention is the reliability of the approval layer itself. If withHuman fails or lags, are the Agent's operations blocked or allowed through? The choice of this fallback strategy directly determines whether the approval layer is a safety net or a single point of failure.

From a product positioning perspective, withHuman targets a real need that is emerging: the stronger the Agent's capabilities, the more urgent humans' need for "controllability." The approval layer is not meant to restrict Agents, but to let teams retain control over key decisions while enjoying automation. Whether this idea can become a standard component of Agent infrastructure depends on whether it can find a sustainable balance between safety and efficiency.

A fallback strategy is a key design dimension for the reliability of the approval layer, referring to the system's behavior when the approval component itself fails, times out, or becomes network-unreachable. There are two common strategies: Fail-Open (allow through on failure) prioritizes business continuity but may let risky operations bypass oversight; Fail-Closed (block on failure) prioritizes safety but causes Agent tasks to stall, and may even affect upstream business.

Most security-sensitive systems lean toward Fail-Closed, supplemented by mitigation measures such as automatic timeout escalation and backup approval channels. Which strategy to choose depends on the reversibility and scope of impact of the operation—for example, irreversible operations such as deleting production data should generally be blocked by default; low-risk operations such as reads may be allowed through. This trade-off, together with the issue of rule granularity, constitutes the core engineering challenge of deploying an approval layer.

One-line Summary

withHuman provides a human approval layer for AI Agent tool calls, balancing automation and controllability through rules and routing.

Paragraph Summary

withHuman is a human approval layer product for AI Agents. Its core idea is to intercept before an Agent's tool call actually executes, with a rules engine automatically allowing routine operations and routing high-risk operations to the corresponding owner on the team for a decision. It achieves cross-framework compatibility through the open protocol AAP, supporting multiple tech stacks including Claude Code, Codex, LangGraph, and Pydantic AI, and adopts a dual deployment model of open source plus hosted, balancing security auditing and the barrier to entry. The article also points out that the solution faces challenges such as balancing rule granularity, concurrent approval efficiency, and the reliability of the approval layer itself (whether to block or allow on failure), arguing that whether it can become a standard component of Agent infrastructure depends on whether it can find a sustainable balance between safety and efficiency.