Human approval is a control step that forces a person to review and confirm a sensitive action before it executes. The action may be a payment, password reset, privilege change, data export, or any other high-impact workflow. In secure systems, this creates a deliberate pause between request and execution.
It matters because automated systems, including AI agents and admin tools, can be tricked, misconfigured, or over-permissioned. Requiring human approval helps stop prompt injection, fraud, accidental deletions, and unauthorized access by adding a second decision point. In practice, defenders pair approval with least privilege, logging, and scoped permissions so the reviewer can see what will happen and why. Attackers often try to bypass this step by hiding details, triggering bulk actions, or abusing workflows that ask for approval too late. Strong approval design makes the control visible, testable, and auditable.