When should AI agents require human approval before acting?

Within its "make humans meaningfully accountable" pillar, Singapore's IMDA specifies when organizations should require human approval before an agent acts: "High-stakes actions and decisions" (e.g. "editing of sensitive data, final decisions in high-risk domains (such as healthcare or legal), actions that may trigger liability"), "Irreversible actions" (e.g. "permanently deleting data, sending communications, making payments"), "Outlier or atypical behaviour" (e.g. "when agent accesses a system or database outside of its work scope, when agent selects a delivery route that is twice as long as the median distance"), and "User-defined" boundaries, where "users may be given the option to define their own boundaries e.g. requiring approval for purchases above a certain amount."

Beyond when to require approval, IMDA argues organizations must also decide what form the approval takes, scaled to the complexity of the decision: "For straightforward actions such as accessing a database, the human user can simply approve or reject," while "for more complex cases, such as reviewing an agent's plan before execution, it may be more productive for the human to edit the plan before giving the agent the go-ahead," and "for high-risk actions, human users can be required to provide an additional written justification before approving or rejecting." The request itself must stay legible: organizations should "keep the request short and clear, instead of providing long logs or raw data that may be challenging to decipher," while still surfacing "the associated risk with the action or a confidence score." IMDA names "alert fatigue and automation bias" and the influence of "anthropomorphic design" as forces that erode this oversight's effectiveness over time, and calls for "measures to ensure continued effectiveness of human oversight" against them.

This extends Does granting agents more autonomy undermine human oversight? by proposing concrete design responses to that erosion — graduated approval triggers and input forms matched to risk — rather than only diagnosing the degradation. It also bears on Can workplace AI risks emerge from interactions alone?: IMDA's "outlier or atypical behaviour" trigger, exemplified by a delivery route "twice as long as the median distance," is exactly the kind of interaction-level anomaly that framework says can escape detection even when no single component is malfunctioning. It also relates to Should AI systems stay collaborative rather than fully autonomous?, giving a concrete mechanism — edit-the-plan approval — for the kind of real-time human correction that note argues autonomous agents still need. A companion note, How should organizations govern the risks of agentic AI?, covers this framework's overall structure.

The excerpt gives no data on how reliably these triggers actually prevent harm, how approval fatigue scales once many agents each carry their own checkpoints, or whether the four trigger categories are jointly exhaustive across agent deployments. IMDA presents this as emerging best practice for organizations to adapt to their own risk appetite, not as a tested or validated control, so the practical payoff is a vocabulary for designing approval checkpoints rather than evidence that any particular checkpoint design works.