Place the approval at the gateway, not inside each agent. The gateway should hold the request, notify a named approver, resume only after decision, and record the approval trail. That keeps policy consistent across agents and prevents every application team from rebuilding pause, retry, and audit logic.
Why the approval point belongs at the gateway, not inside each agent
High-risk MCP tool calls need one shared control point because the decision is about action approval, not about which agent happened to make the request. A gateway can hold the call, route it to the right approver, and resume execution only after an explicit decision. That keeps the policy consistent across teams and prevents each application from inventing its own pause and audit flow.
That design also reduces drift. When approval logic lives inside agents, teams tend to copy the pattern differently, which creates uneven thresholds, missing logs, and inconsistent exception handling. A gateway makes the approval step part of the transport and policy layer, so the same gate applies whether the request came from one agent, many agents, or a changing set of tools.
For MCP-specific implementation guidance, the MCP Gateway and MCP Server Governance Guide is the natural place to anchor gateway design, approval tiers, and rollout decisions. If the approval pattern is being added to an agent runtime, the Human-in-the-Loop for AI Agents Guide covers the approval-gate mechanics that matter most in practice.
How to design the approval flow so it is actually enforceable
The gateway should treat the approval as a stateful transaction: receive the request, pause it, identify the approver, capture the decision, and only then release the tool call. The request context needs to survive the pause so the approver can understand what the agent wanted to do, what data or system is affected, and what scope is being approved. If that context is lost, the approval becomes ceremonial instead of meaningful.
Named approvers matter more than generic queues for high-risk actions. If a team cannot tell who approved what, the control is weak even when a button was clicked. The approval record should include the request payload, the approving identity, the timestamp, the tool or resource involved, and the decision outcome so the trail supports both review and later investigation. The AI Agent Identity Security: The 2026 Deployment Guide is useful where the approval depends on bounded agent identity and short-lived authority.
For protocol-level grounding, the MCP authorization specification explains why gateways should think in terms of bounded access and server-side authorization rather than passthrough trust. Model Context Protocol: Authorization specification is especially relevant when the approval flow must align with audience-bound tokens and controlled resource access.
What can go wrong if teams embed approval inside each agent
When approval logic is scattered across agents, the biggest failure mode is inconsistent enforcement. One team may require approval for a destructive tool call while another silently skips it for the same class of action. That creates policy gaps, audit gaps, and a false sense of control because “human approval” exists in the design but not uniformly in the runtime.
There is also an availability risk. If approval is coded per agent, every agent must handle wait states, retries, timeout handling, and resumption correctly. Small differences in implementation can lead to stuck workflows, duplicate actions, or silent fallbacks when the approver is unavailable. Centralising the gate makes the approval path easier to test, easier to monitor, and easier to recover when the process fails. The MCP Incident Response Playbook is a useful companion when a tool call has already been exposed or abused and you need a clean recovery path.
Risk and Threat Considerations
High-risk tool calls are attractive to attackers because they can turn a normal agent action into an authorised-looking destructive step. If approval lives inside the agent, an adversary that manipulates prompt context, tool selection, or execution flow may also influence whether the approval path is triggered, logged, or correctly resumed.
Failure mechanism: distributed approval logic creates inconsistent thresholds and weak observability, which makes it easier for a malicious or misdirected tool call to bypass meaningful human review or to be replayed after an incomplete pause.
Impact: unauthorised tool execution, credential or data exposure, and a poor audit trail can follow, especially when the same agent family is deployed across multiple teams with different code paths and exception handling.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 sets the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Approval gates limit agent authority for high-risk tool calls. |
| ASI02 — Tool Misuse | The question concerns controlling risky tool invocation by agents. | |
| ASI09 — Human-Agent Trust Exploitation | Human approval is meant to prevent trust abuse in agent workflows. | |
| Recommendation — Enforce gateway approval before privileged agent actions execute. Gate risky tool calls and review tool intent before execution. Require explicit human confirmation for actions that could exploit misplaced trust. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Gateway approval is a least-privilege boundary for high-risk actions. |
| AU-2 — Event Logging | The approval trail needs auditable records of decisions and actions. | |
| IA-5 — Authenticator Management | Approval workflows often depend on tightly managed credentials and access. | |
| Recommendation — Constrain agent permissions so risky actions require explicit approval. Log each approval request, decision, approver identity, and resumed action. Manage approver and gateway credentials with short-lived, controlled access. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | A gateway approval step is an access-control decision for high-risk actions. |
| A.8.15 — Logging | The approval trail is an audit record that must be retained and reviewable. | |
| Recommendation — Centralise approval decisions within a controlled access policy boundary. Record and retain approval events so risky actions remain traceable. | ||
Practitioner Guidance
What to prioritise: Put the approval boundary where the organisation can enforce it once, not where each application team can interpret it differently. For high-risk MCP calls, the control should be owned by the gateway, with the agent limited to requesting action and the gateway responsible for pause, notification, and resumable execution.
What to verify: Test the full approval lifecycle, not just the user interface. You should be able to prove that the request pauses before the tool call runs, that the approver identity is bound to the decision, and that the audit trail survives retries, failures, and delayed responses without losing the original request context.
Practitioner takeaway: Treat human approval as a shared control-plane capability, because the moment each agent owns its own approval logic, consistency and auditability start to erode.
Related resources from NHI Mgmt Group
- How should teams design human approval for MCP tool calls so reviewers are making bounded decisions instead of acting as a generic yes or no gate?
- Why do AI agents need out-of-band approval for high-risk tool calls?
- Why do AI agents create new risk in non-human identity management?
- Why do AI agents increase non-human identity risk in existing IAM programmes?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org