There is a class of failure that only shows up the week you let an AI agent touch something real. A support agent issues the same refund twice. A coding agent restarts the payments service at peak traffic. A research agent deletes the calendar event it was asked to summarise. Each of these has the same shape: the agent did exactly what it was told to do, and nobody was standing between the decision and the damage. withHuman is a human approval layer for AI agents built to stand in that exact spot. Our verdict, up front: it is the most honestly designed approval tool we have seen in this space — a real gatekeeper, open source, with an open protocol at its core — but it is early, and the hardest parts of approvals are organisational, not technical. If your agents touch money, customer data, or production systems, withHuman is worth an evaluation this quarter. If they do not, bookmark it and move on. This review covers what the tool does, how its Agent Approval Protocol works, what it costs, who should adopt it, and the limitations its own makers openly admit to.
What is withHuman? A human approval layer for AI agents
withHuman was built by the team behind Metoro, an AI SRE agent that diagnoses production incidents and proposes fixes. As they tell it in their launch announcement, Metoro was good at working out the fix — the problem was getting customers to let it apply one. Nobody wants to hand an agent admin rights on a production cluster and find out which kind of rollback this one is going to be. So the team did what most agent companies end up doing: they built an approval step. The action would sit in a UI until someone approved it, and then it would run. Customers started letting the agent do more. But three problems kept surfacing.
First, every customer answered the same questions differently: who is on call for this service, is a restart acceptable at night, does the payments team want to see every change in their namespace. Those are questions about how a company runs, not about any one agent. Second, the permissions were too blunt — you could let the agent restart pods or not, with no way to say “restarts are fine, unless it is the payments namespace, in which case ask someone on payments.” So most teams picked the safe option and the agent spent its time making suggestions instead of fixing things. Third, Metoro was never the only agent. Customers had coding agents on every laptop, a support agent in the helpdesk, and weekend-built internal agents — each with its own separate approval settings. A team with five agents had five permission systems, and nobody could answer the simple question of what their agents were actually allowed to do.
withHuman is the answer they settled on: one approval layer for every agent a company runs. It comes in two pieces. The first is the Agent Approval Protocol (AAP), a small open specification that defines how agents ask for a decision and wait for the answer. It was deliberately separated from the product so others can implement and contribute to it, and it ships with prebuilt hooks for coding agents like Claude Code and Codex, SDKs for Python and TypeScript, and drop-in libraries for popular frameworks including Deep Agents, LangGraph, Pydantic AI, and Mastra. The second piece is withHuman itself: the centralised place where you write your rules and define who gets asked when a call needs a person. It is open source, with a hosted version the team runs.
How it works: stopping the tool call, not the agent
The design decision that matters most is where the interception happens. Approval does not happen at the prompt, the plan, or the agent’s reasoning — it happens at the tool call, the moment the agent actually goes to issue the refund or run the migration. The agent calls its tool exactly as it normally would. Something wrapping the tool — a hook or one of the SDKs — holds the call and sends withHuman a request describing it. withHuman runs that request through your approval pipelines: your rules. A rule can approve the call automatically, deny it outright, ask a model or a service of your own for a judgement call, or decide it needs a person.
When it needs a person, an escalation path picks who to ask — for example, whoever is on call for the team that owns the system being touched — and notifies them wherever they will actually notice: Slack, Discord, email, text message, WhatsApp, or the mobile apps for iPhone and Android. The reviewer sees the tool call plus the context of the request, approves or denies, and withHuman sends the decision back. An approved call runs as normal. A denied one fails, and the agent sees that it was denied along with the reason. Two properties of this architecture are worth underlining. The approval is transparent to the agent, which means the agent cannot forget to ask — and it cannot be talked out of asking by a cleverly worded prompt. And the rules belong to the organisation, not to each agent: support decides how refunds get approved regardless of which agent issues them, and you do not rebuild that logic every time someone adopts a new framework.
What withHuman costs
The core product is open source, and the Product Hunt launch page lists the entry price at zero. There is also a hosted version, and the launch materials include a promo code offering three months of the Scale tier free — which tells you a paid tier exists even though full public pricing was not published in the launch materials. Practically, the total cost of ownership question is about where you run it. Self-hosting the open-source core means you own the uptime, and the fail-closed design (more on that below) puts the approval layer squarely in your agents’ critical path. That is a reasonable trade for a security boundary, but it is not free: budget for monitoring and redundancy the same way you would for any control plane your automations depend on.
Who should evaluate it — and who should wait
withHuman fits teams whose agents already touch consequential systems: support agents issuing refunds through Stripe, agents paying supplier invoices, sales agents writing to the CRM, or operations agents that can restart, scale, or reconfigure production infrastructure. It also fits organisations running a mix of frameworks — Claude Code on laptops, LangGraph services, a few custom agents — that currently maintain a separate set of approval settings for each and want one rulebook. If you are already spending money on agents, it pairs naturally with cost discipline: see our review of Navige, an AI agent cost-management tool, for the FinOps side of the same problem.
Who should wait? A solo developer with a single coding agent gets most of the value from that agent’s built-in permission prompts. Teams whose agents only read data — research, summarisation, analytics — are not gating anything consequential and would be adding a control plane to a read-only workflow. And if what you actually need is a compliance checkbox with guaranteed, evidence-grade human review for auditors, verify the audit-logging story in detail before committing; an approval pipeline is a control, but it is not automatically an audit trail.
Watch-outs: the honest limitations
Credit where it is due: the makers are unusually candid about what is not finished. Their launch post has a whole section on what they are still figuring out, and it is the most useful part of the documentation. Here is what to weigh.
- It fails closed. On the Product Hunt page, the team confirmed that if withHuman itself is down, the tool call fails rather than going through. That is the conservative and correct choice for a security boundary — a $25 refund should not sail through just because the gatekeeper had an outage — but it means your approval layer is now load-bearing infrastructure. They are exploring caching rules at an intermediary layer that could survive a brief upstream outage, but that is future work, not a feature.
- Currently MCP tool calls only. The launch version gates MCP tool calls, which is a sensible starting point since MCP is a well-used standard and an easy place to hook in. But plenty of agent actions do not go through MCP — HTTP requests made through a CLI or a script, for example — and those are not gated yet.
- The reviewer-context problem is real. A tool call on its own is often not enough for a human to decide well. Its arguments can be full of opaque identifiers — a customer ID, a commit hash — that mean nothing until someone looks them up. Ideally those get enriched into something meaningful, like the customer’s name and plan, before the reviewer sees the request. Until that enrichment exists, reviewers will either rubber-stamp or block everything, and both failure modes are bad.
- An agent holding its own credentials can bypass the gate. This is the deepest caveat in the whole design. If a coding agent can read your GitHub token, it can skip the gated tool and call the API directly with curl. Robust approvals require removing credentials from the agent’s environment. withHuman’s built-in MCP Gateway does this for MCP servers — it holds the credentials so agents never see them — but CLI tokens and API keys in environment variables are harder. Approvals plus credential hygiene, not approvals alone.
- Approval fatigue is the real enemy. The makers observed that if every routine action pings a human, people start approving without reading — which gives you the delay of human review without the review. They cite teams aliasing their coding agent to skip permissions entirely as the cautionary tale. The default has to be automatic: the $10 refund just happens, the $10,000 one waits. If your rules escalate everything to a human, you have not built a safer agent; you have built a slower one.
How it compares to the alternatives
The most common alternative is doing nothing structured: relying on each agent’s built-in permission prompts. Those are fine for one developer and one agent, but they do not scale — settings differ per agent, there is no organisation-wide view of what agents may do, and a prompt is, by nature, something the model can be argued out of. The second alternative is the DIY route: a Slack bot that holds actions until someone reacts. That works, and plenty of teams have built one, but you end up building escalation chains, durable approval state for when the agent crashes mid-wait, reminders, and audit logs yourself. It is fine for one team and it rots at five.
A third pattern looks similar but solves a different problem: end-user confirmation flows, such as async user-confirmation patterns in auth frameworks, where the human being asked is the end user of an app. withHuman is about team operations — the on-call engineer, the support lead — not the consumer. A fourth is platform-specific: GitHub’s newer agentic workflow approvals hold suspicious Actions runs for human review, which is excellent inside CI/CD and irrelevant everywhere else. withHuman’s bet is that the winning position is one rulebook, framework-agnostic, built on an open protocol so the mechanism itself is not a vendor lock-in. That is a genuinely different claim from “another approval UI,” and it is the reason this launch is worth paying attention to even at this early stage.
From our experience: approvals are a workflow, not a product
We have built and deployed AI agents for clients across support operations, sales workflows, and internal tooling, and here is the practitioner truth: the approval UI is about twenty percent of the work. The other eighty percent is everything around it. Who is on call and actually awake when the request lands. What context a reviewer needs to make a correct decision in ten seconds rather than ten minutes. What “denied” means for the agent’s next step — does it retry, stop, or ask the user? And rule hygiene: approval rules are living policy, and stale rules are a second outage waiting to happen. Review them quarterly, the same way you review access permissions.
Our recommended starting point is the money. Gate refunds, payments, and invoice runs first — the actions with a direct financial blast radius — and expand to data and infrastructure writes only after the team trusts the workflow. Resist the temptation to escalate everything; the fatigue problem the withHuman team describes is the number-one reason approval systems get bypassed in practice. And do not adopt it as a compliance checkbox: if your auditors need guaranteed human review with evidence trails, verify the logging story on a real deployment before you commit. Used with those caveats, a centralised approval layer is one of the highest-leverage investments an agent-heavy team can make this year. If you are scoping an agent project and want help drawing the trust boundaries before code ships, talk to our team — it is considerably cheaper than the incident.
Frequently asked questions
Is withHuman open source?
Yes. The core approval product is open source, and there is a hosted version run by the team. The Agent Approval Protocol — the open specification defining how agents request and wait for decisions — was deliberately kept as a separate project so other vendors can implement, adopt, and contribute to it.
Which agent frameworks does withHuman work with?
It ships with prebuilt hooks for coding agents like Claude Code and Codex, SDKs for Python and TypeScript, and drop-in libraries for Deep Agents, LangGraph, Pydantic AI, and Mastra. The design is framework-agnostic: the interception happens at the tool call, so the agent framework does not need to change.
What happens if withHuman goes down?
It fails closed: held tool calls fail instead of proceeding. The team chose this deliberately, arguing that a security boundary should not let consequential calls through during an outage. The trade-off is that your approval layer becomes load-bearing infrastructure, so plan for redundancy. Rule caching at an intermediary layer is being explored as future work.
Does withHuman gate non-MCP tool calls?
Not yet. The launch version intercepts MCP tool calls. Gating other action types — such as HTTP requests an agent makes through a CLI or a script — is on the makers’ own roadmap of unsolved problems, so check the current documentation before assuming coverage.
How is this different from Claude Code’s permission prompts?
Permission prompts are per-agent settings with no organisation-wide view, and the agent is part of the asking — it can, in principle, be prompted out of asking. withHuman moves the rules to the organisation level, applies one rulebook across every agent, and holds the call outside the agent so the agent cannot skip or negotiate the gate.
withHuman is early, but it is pointed at the right problem with unusual honesty about what is unfinished. For a broader look at the tools reshaping how teams build with AI, browse our AI Tools Directory.