Should agents pause for a human before sending mail or closing tickets?

You’re right to want a deterministic pause, not a polite paragraph in the instructions. Prompt text is advice; a gated tool call is a control.

Here’s what’s going on. Microsoft 365 Roadmap 570434 (status In development, GA timing September CY2026 on the roadmap — verify for your cloud) describes a per-tool, per-agent toggle so makers can require a person to approve, approve for the session, or deny before the agent runs that tool. The approval request describes what the agent intends to do and appears inline in the channel where the agent is deployed — including Microsoft Teams and Microsoft 365 Copilot. That matters for high-stakes side effects (send mail, close tickets, process payments): the guardrail is independent of how clever the agent’s instructions sound on a good day. Separately, Learn documents multistage and AI approvals in agent flows (preview on Learn): manual stages for human stakeholders and AI approval stages that return Approve/Reject with a rationale against your criteria — with the explicit guidance that humans stay in control for critical or exceptional cases. FAQ for AI Approvals is blunt about what not to automate alone (health, safety, legal status, discipline, and other high-stakes decisions). Agent Framework docs also show the same pattern for code-first agents: mark tools so execution waits on human approval. None of this replaces admin controls (DLP, connector policy, MCP tool registry block/approve, publish approval) — it’s the runtime seatbelt after the tool is already allowed.

Steady before scale: Pane 04 Security owns which tools may fire without a human; Pane 05 GRC owns the evidence trail of who approved what. Schofield’s Third Law (historically attributed) applies with teeth — the easier it is for an agent to send mail or close a ticket, the easier a poorly steered or compromised run does the same.

Options that actually work:

1. Classify tools by blast radius; gate the write/side-effect class by default. Send-mail, ticket-close, payment, delete, and external write → human approval required on production agents. Read-only knowledge tools stay ungated. Best Steady default once 570434 is available in your tenant.
2. Pair runtime approval with agent-flow multistage approvals for processes that already need named stakeholders (expense, vendor, contract). Use AI stages only for routine, well-defined criteria; keep a human stage for exceptions. Good for Wave 0 process agents.
3. Rely on “the instructions say ask first.” Fast until the first autonomous run that doesn’t.
4. Approve every tool call for every agent. Queue theatre; people click Approve for the session and the control evaporates.

12 Panes action / comms: Tell makers: High-stakes tools need the approval toggle — prompts aren’t a control. Tell Security: Own the tool classification table; block at registry/DLP first, then gate what you allow. Process owners: Name who receives inline approvals in Teams/Copilot, and what “approve for session” means in your risk appetite. FinOps: Approvals and AI approval stages can consume time and credits — design for exceptions, not for rubber-stamping every read.

Benefits / risks: Deterministic pause before side effects; roadmap and preview surfaces move; “approve for session” can widen blast radius if misused; AI approval stages are not a substitute for human accountability on high-stakes decisions; someone must own the approval queue or the agent stalls. Verify Message Centre and Learn for what your harness and cloud show today.

I’d suggest this week: list every production tool that can write outside the chat, mark which ones need a human, pick one Wave 0 agent to pilot the approval pattern (or multistage flow if tool-call gating isn’t in your tenant yet), and write a one-page “who may Approve for session” rule. You’ll get Steady Security without pretending the system prompt was ever a pause button.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer