Human oversight of Web agents
Design approval gates before consequential actions.
Distinguish observing from acting
Reading a page or organizing results carries different risks from sending messages, deleting files or completing transactions. Separate read, draft and execute capabilities with different approval conditions.
Meaningful consent
Users should understand the tool identity, action target, shared data and likely consequences before confirming. Invisible blanket permission is not a substitute for informed approval of a specific operation.
Log and remediate
Retain requests, approvals, tool calls and outcomes while minimizing private data. An action can fail despite a seemingly positive response; inspect final state in the affected system.
Reversibility and bounded autonomy
Use minimum privileges, time limits, confirmations for irreversible actions and cancellation paths. Oversight is not just a confirmation screen: it is an enforced technical policy.
Technical rather than symbolic permissions
Human consent should cover a specific operation, recipients, data and consequences. A confirmation dialog is insufficient if software can bypass it or if a token already has overly broad permissions. Server enforcement, token expiry and transaction state must support the approval UI.
Exercise: consequential page edit
An agent proposes replacing a source in an editorial page. Before execution, show the diff, rationale, evidence and authorized reviewers. If approved, retain history and inspect the final render; if rejected, no write should happen. Test interruptions and network failures as well.
Core steps
- 01Classify action risks
- 02Define permissions
- 03Test approval gates
- 04Verify final system state
Three questions to ask
Who can cancel or reverse the action?
Can users see which data is shared?
Is the final outcome independently checked?
Read the source documents
Versions, reuse terms and document status can change. Check them on the original sites.