Open source. Not deployable to production. This page states what the tests prove and what is missing — nothing else.

What is a human approval boundary?

Human approval boundary, defined

People ask this as: what is a human approval boundary, human in the loop approval for ai agents

A human approval boundary is a point in an automated process where the system refuses to let software — including an AI agent — record the final decision, and stops until a named human decides. The defining property is that the refusal is executable behaviour asserted by tests, not a guideline in a prompt. In Accordo an agent actor asking to approve a discounted quote is refused with a 403, and a renewal above the policy threshold parks until a human decides — while the boundary's own limit is stated in the same breath: the actor is asserted in a header, never authenticated, so it holds against an honest agent and not against an attacker.

Where this stops

Read this before the rest of the page. Every line below is a thing this does not do.

  • The boundary is executable behaviour, and only that. It refuses an agent the decision; it does not authenticate anyone, because there is no authentication to do it with (L-01).
  • It holds against an honest agent that declares itself. A caller that asserts a false actor type is not stopped, which is why the server must stay local.
  • requiredApprovalKey is a label, not a role. Nothing verifies which human decided, only that the deciding actor was a user.
  • The discount refusal is asserted inside a composite end-to-end test, not a test named only for it. The renewal refusal has its own named test.
  • Refusing the decision is not refusing the work. An agent may prepare everything up to the decision and read all the evidence after it.
  • The framework does not judge the human's decision. There is no second signature and no review of whether the approval was wise.

No authentication, tenancy or RBAC. The server is local-development-only. An actor header is an assertion, not an identity. Do not expose it to a network. Every claim and every limitation is on one page.

The definition, and why prompts do not implement it

A human approval boundary is a designed stopping point: the process may prepare, calculate, recommend and stage a decision, but the decision itself can only be recorded by a human actor, and an automated caller that attempts it is refused. The boundary is a property of the server, which is what separates it from an instruction. A prompt that says ask a human first is guidance a model may follow; a service that returns 403 to an agent actor is behaviour that does not depend on the model's cooperation.

The second half of the definition is what a refusal must preserve: a refusal that leaves state changed underneath it is not a refusal. A real boundary rejects the caller, keeps the pending decision pending, and leaves the record in the state it was in — all three assertable by a test.

The two boundaries Accordo asserts

The renewal boundary: commercial policy is deterministic code, and a renewal at or above the policy threshold stops and waits for a named human (C-03). A named test runs the stage-change workflow with an agent actor, takes the pending approval that policy created, attempts the decision with the same agent actor, and asserts the rejection — and then asserts that the approval is still pending and the opportunity unmoved (C-04).

The discount boundary sits where the money is: the approve and reject actions on a quote accept only a user actor, and an agent actor is refused with 403 HUMAN_APPROVAL_REQUIRED (C-21). One decision is allowed per quote version, the decision and the quote lifecycle commit atomically, and every step leaves an audit event and a trace (C-16). That refusal is currently asserted inside a composite commercial end-to-end test rather than a test named only for it — a page citing it should cite tests/commercial-e2e.test.js, and this one does.

Where the boundary stops

The actor is an assertion, not an identity. There is no authentication, tenancy or RBAC, and an actor header is a claim the caller makes about itself (L-01) — so the boundary holds against an honest agent that says what it is, and not against any caller that lies. That is why the server is local-development-only.

The approval key is a label: nothing checks that the human who approved was a sales manager, because there are no roles to check, which is why obtaining the required commercial approval reads partially supported in the job catalogue and enforcing team or tenant permissions reads not supported. And refusing the decision is not reviewing it — the framework decides who may decide, never whether the human decided well.

The evidence this page rests on

Claims and limitations are printed from site/claims.json word for word. Job statuses come from docs/benchmarks/jobs.json; a job with no page of its own is listed with its status rather than linked.

Claims

  • C-03 Commercial policy is deterministic code, not a model's judgement: a renewal at or above the threshold stops and waits for a named human.

    LimitProven for the built-in renewal object and its single value threshold. A general policy engine over arbitrary custom objects does not exist.

  • C-04 The agent cannot approve on the human's behalf. A test asserts the refusal, so the boundary is a property of the system rather than a promise in a README.

    LimitThe actor is asserted, not authenticated: there is no auth, tenancy or RBAC, and an actor header is not identity. This holds a boundary against an honest agent, not against an attacker with network access.

  • C-16 Every mutation goes through a module service or a named workflow, and leaves an audit event and a step-level trace behind it.

    LimitAudit records what the process did under an asserted actor. It is not a tamper-evident or externally attestable log, and it is not a compliance control.

  • C-21 The same refusal holds where the money is: an agent actor asking to approve a discounted quote is refused with a 403, and only a human user actor can decide.

    LimitThe assertion lives inside a composite end-to-end test rather than a test named for it, so the citation is a file and a line rather than a test name. Extracting it into a named test is tracked in docs/strategy/GO_TO_MARKET.md; until then, cite the line.

Limitations

  • L-01 No authentication, tenancy or RBAC. The server is local-development-only. An actor header is an assertion, not an identity. Do not expose it to a network.

Jobs it covers

Documented in

Proved by