Guardrails and Human-in-the-Loop: Keeping AI Agents Safe

Understand Excessive Agency, prompt injection and the lethal trifecta, and how to layer guardrails and approvals that do not become a bottleneck.

The accounts team at a distribution company wants an AI Agent to help with payables: read invoices sent by email, match them against purchase orders in the ERP, and set up payments. It sounds like a big time saver, until someone asks the question that should have come first: "What if a fake email attaches an invoice with hidden instructions telling the agent to change the payee's bank account?" The answer to that question is guardrails and human-in-the-loop.

What are guardrails and human-in-the-loop

Guardrails are protective layers that limit what an agent takes in, what it can do and what it sends out. Human-in-the-loop (HITL) means designing the system so a person decides at risky points, before the agent does something that cannot be undone. One does not replace the other; they work together.

Risks to understand before you design

Excessive Agency

The OWASP Top 10 for LLM Applications 2025 lists Excessive Agency as LLM06 and names three root causes: tools with more functionality than needed, more permissions than needed, and more autonomy than needed, meaning actions without enough checks.

Prompt injection

LLM01 on the same list is Prompt Injection. Content the agent reads, such as web pages, emails or attachments, can contain hidden instructions that trick the agent into following them.

The lethal trifecta

Simon Willison, a developer who writes regularly about LLM security, summarised it in a June 2025 post: an agent is dangerous when it combines three things: access to private data, exposure to untrusted content, and the ability to communicate externally. He also warns that a protection tool that catches 95% of attacks sounds good, but in web security that is "very much a failing grade".

The payables agent in our example has all three: it sees company account data, reads external email, and can issue payment instructions.

Layer your defences

1. Limit tools and permissions: the agent can read the ERP but cannot edit vendor records. Use the narrowest API key possible
2. Separate untrusted content: text from external email is data, not instructions, and bank details must never be changed based on email content
3. Check outputs with rules: amounts must match the purchase order and the bank account must match the registered vendor record. If not, stop
4. Have people approve high-risk actions: every payment goes through a human
5. Log every action: so you can trace who approved what

Designing human-in-the-loop that is not a bottleneck

If people must approve everything, the team gets tired and starts approving without reading. A better approach is to tier by risk:

• Read-only: such as looking up purchase orders, runs automatically
• Drafts: such as preparing a payment list, allowed, but with no real effect yet
• Irreversible: such as paying, deleting data or sending external messages, requires human approval

No-code tools such as n8n already support this. n8n's documentation explains that when an AI Agent tries to use a tool flagged for review, the workflow pauses and waits for a person. The reviewer sees which tool the AI wants to call and with what values, and can approve through channels such as Slack, Microsoft Teams or Gmail. If denied, the action is cancelled and the AI is told. n8n also suggests starting with review turned on and reducing it as trust grows.

Major products follow the same idea. When OpenAI launched ChatGPT agent (July 2025), it said the agent is trained to ask permission before actions with real-world consequences, such as purchases, and to refuse high-risk tasks such as bank transfers.

Watch out for

• No guardrail is 100%: design so the damage stays limited even if an attack succeeds
• Approval fatigue: if you ask for approval too often, people click through automatically, which is about as bad as no approval
• Personal data and regulation: work involving finance or customer data should be reviewed with your legal team or a professional before going live

Let the agent work fast, but let a person sign off wherever there is no undo.

How to get started

1. List every tool the agent has and label it read, draft or irreversible
2. Check whether the agent has the full lethal trifecta. If it does, remove one leg or put a human in between
3. Cut API key permissions down to what is actually used
4. Require approval only for the high-risk tools
5. Test with emails or documents containing hidden instructions before going live

For the basics of letting AI call real systems, read What is Tool Calling, and if you want to build an agent with an approval step yourself, start with the course Build an AI Automation Agent with Make and n8n.