Human-in-the-loop approvals — CIBA & RAR

An AI agent that can spend money should never spend it alone. Human-in-the-loop means the agent proposes and a person decides, on a channel the agent does not control. Your goal: add a human approval to risky agent actions.

Reads run free, writes wait

You told an assistant, "Keep my subscription topped up." Days later, Kai, your AI agent, wants to buy a ₹500 add-on. Reading your balance can run. But writes go back to the person who pays. Writes are purchases, plan changes and payments. Three easy shortcuts all fail.

The right shape: ask the IdP

The agent's request goes to your IdP (identity provider: the system that issues your logins and tokens). The IdP reaches you on a channel the agent cannot touch, such as your enrolled phone. Only a "yes" from there lets the action go ahead. This standard is CIBA (Client-Initiated Backchannel Authentication). It approves with a push message and no browser redirect. The agent waits by asking the token endpoint again and again. This is polling.

The binding message: approve what you see

People get tired of approvals (approval fatigue). A vague prompt such as "Approve login?" can trick them into approving an attacker. So the request carries a binding message. It is a short, readable text about the deal, like BUY-4821 · 5 GB add-on · ₹500. It shows on the page and on the phone. If they match, approve. If not, deny. You approve a specific deal, not a mood.

RAR: details for machines

RAR (Rich Authorization Requests) adds a structured authorization_details object to the request. It holds a type, an amount, a currency, a recipient and a reference. The binding message informs the human. The authorization_details object informs policy and audit. Rules can act on the amount, and machines can read the record of what was agreed.

Custody: where the pending approval lives

While the approval is pending, everything sensitive stays on the server. That means the request id and, later, the token. The page holds only an opaque handle, a random label with no meaning. The browser polls "any news?" and shows the status. It cannot replay or finish the grant. The agent finally gets a credential scoped to the approved action, not the user's whole session. MCP governance decides that an action is a write and pauses it. CIBA is how that pause reaches a human at scale.