AI agents that ask for approval before they act (2026)

Dash, Claude Cowork in its default Manual mode and Microsoft 365 Copilot agents on plugin actions ask for approval before acting, with no setup. AI by Zapier, Copilot Studio, Power Automate, n8n and Make can pause for a person too, but only after someone turns the approval on or builds it.

For a team of 5 to 100 people with no IT person, that difference decides it. Nobody is going to build an approval step into every workflow, so the agent’s default is the rule you’ll live with. We built Dash to start from asking: it reads and drafts on its own, and anything that goes out, files or spends money comes back into the Microsoft Teams chat or Slack thread with an approval on it. Dash drafts, you ship.

Which AI agents ask for human approval before sending emails or making changes?

Here’s what each agent does with no setup when it’s about to do one of four things a small team would want to check first. “Asks by default” means it asks before anyone changes a setting. “You turn it on” and “You add a step” mean someone has to set the approval up.

Defaults as each vendor documents them, as of October 21, 2026.

The split is in the setup. Zapier says the “Require approval before running” toggle in AI by Zapier “is off by default, so the tool runs without interruption unless you turn it on.” In Microsoft Copilot Studio, the “Ask the end user before running” option “is set to No by default.”

A default isn’t a lock, ours included, and the other rows have their own fine print:

• Microsoft 365 Copilot: the first time Copilot uses a plugin that connects to another app (an MCP or API plugin), Microsoft says it “asks them to allow or cancel the operation.” After that, reads don’t ask, and other calls prompt, “showing the data to be sent.” A plugin’s maker can switch the prompt off. This covers plugins in declarative agents, not every Copilot feature.
• Claude Cowork: Manual is the default mode, and tools you mark “Always allow” skip the prompt. Auto mode swaps the prompt for Claude’s own safety check, and Skip mode removes it.
• Claude Tag: the prompt covers your own connectors. The Claude Tag pages we read don’t describe an approval step for writes through connectors an admin attaches to a channel.
• Lindy: Lindy’s FAQ says “anything with outside impact waits for approval.” Its guardrail settings also offer Always allow, and guardrails apply in shared Slack threads only, not in DMs, web chat, iMessage or SMS.
• n8n and Make: you build the approval into the workflow. Make’s Human in the Loop app is for Enterprise customers and in closed beta, and its AI Agent guidance suggests telling the agent to send its output to you on Slack.

Three more let you require a check but don’t name a default. Salesforce tells Agentforce makers to “enable Require user confirmation” for custom actions that change data or send email. ChatGPT’s connected apps have four permission levels, from Always ask to Allow all actions, and the help page names no default. ChatGPT workspace agents ask before steps like sending an email if the builder requires it. HubSpot’s prospecting agent offers “Review emails” or “Send without review.”

Human-in-the-loop AI tools for small business teams with no IT person

Human-in-the-loop means the agent stops between proposing an action and doing it, and a person says yes or no. Human-on-the-loop is the looser version: the agent acts, and a person watches and can step in. For a small team with no IT person, the human-in-the-loop tools that fit are the ones that ask with no setup.

Ask an AI assistant, though, and it mostly points you the other way. The Dash team asked ChatGPT, Google AI Mode, Gemini and Claude six questions about AI agents that ask for approval, three times each, on October 18, 2026. Of the 69 answers, 49 named an automation builder where you design the approval step yourself (Zapier in 42), and 41 named an enterprise platform run by IT, such as Copilot Studio or Agentforce. Together, 57 named at least one of those two kinds: a tool you build yourself or one IT runs. It’s what four AI assistants said on one day, not market share. If you’re choosing an agent on setup and price as well, our guide to the best AI agents for small business compares nine of them.

Which AI agent actions should need approval: email, CRM changes and payments

Ask for approval on actions that leave the conversation and are hard to take back, and let the rest run. The OWASP GenAI Security Project says to “require a human to approve high-impact actions before they are taken,” and its example is an app that posts to social media for a user, which “should include a user approval routine” for the post. OpenAI’s guide to building agents rates each tool on “read-only vs. write access, reversibility, required account permissions, and financial impact.”

Here’s how Dash sorts business actions by default.

1. Runs on its own

   The result stays in your conversation with Dash.

   • Reading data from your connected tools
   • Calculations, queries and analysis
   • Drafts that land in your DM with Dash
   • Answers in the thread you asked from

2. Asks first

   It changes another system or reaches other people.

   • Sending an email
   • Posting in a public channel or on social
   • Writing to your CRM: a new deal, a contact update, a stage change
   • A Stripe charge or refund
   • Creating or editing events on someone else’s calendar

3. Off until someone turns it on

   It can’t be undone, so Dash can’t run it at all.

   • Permanently deleting or purging records
   • Deleting a code repository or branch

The rule of thumb from how approvals work in Dash: “If the result only lives in your conversation with Dash, no approval is needed.” A reply in the thread you asked from runs; the same words sent to a client wait for a yes.

The safest AI agents for small business: permission controls, approvals and who says yes

Permission and approval are two separate controls. Permission is what the agent can reach: which tools, which accounts, and whether it has read or write access. Approval is when it stops and asks. A safe setup needs both, and it needs a clear answer to who is allowed to say yes.

In Dash, every operation on each of your connected tools is set to Auto, Ask or Off, and a workspace admin decides whether a connection is shared with the workspace or kept private. New Gmail and Outlook connections start private, so connecting your inbox doesn’t open it to the whole team.

Who can approve differs from tool to tool:

• Dash: anyone with access to the connection can approve or deny a pending action, not only the person who asked. If you want a manager to sign off, a workspace admin can name designated approvers for that tool. Either way, the action runs as whoever asked Dash, with their access checked again at that moment.
• Lindy: “The person who asked can approve their own request, and so can any workspace owner or admin.”
• n8n: in its Slack approvals, an empty approver list means “anyone who can see the message can approve or decline.”
• Microsoft Copilot Studio: in multistage approvals, a preview feature, the builder names the approvers, and Microsoft’s example sends anything over $5,000 to a manager.

Afterwards, someone should be able to see what was approved. Dash’s Activity feed logs every approved or denied action, every change to approval settings and designated approvers, and each tool call with the person Dash acted for. Workspace admins and owners can see it.

AI teammates in Microsoft Teams or Slack that ask for approval before spending money or posting publicly

A charge or a public post is hard to take back once it’s out. Here’s which agents in the table ask before either one with no setup, and where the request shows up:

• Dash, in Microsoft Teams or Slack: asks before a Stripe charge or refund, a post in a public channel and a post on social. The approval card lands in the same Teams chat or Slack thread, with Approve, Always approve this action (Always approve in Teams) and Deny.
• Microsoft 365 Copilot agents: plugin actions that do more than read prompt first. Microsoft’s page doesn’t list payments or posts by name.
• Claude in Slack: on Allow, Claude “checks with you before posting anything that looks sensitive,” and on Allow with review it “shows you every result to approve before it posts to the channel.” Its docs don’t cover spending money.
• Lindy, in Slack: a guardrail set to Require approval “asks in Slack before writing.” Its docs don’t cover spending money either.

In the tools you build yourself, the request goes where you send it. Zapier’s Human in the Loop step notifies by email, Slack or a triggered Zap, with no Microsoft Teams option. n8n can route approvals to Microsoft Teams, Slack and other channels. Copilot Studio’s multistage approvals reach people in the Microsoft Teams approvals app, Outlook or the Power Automate portal.

Here’s the money case in one of Dash’s scripted property management demos. A $290 gutter-clearing quote goes to Aaron for approval in his direct messages, and Dash reports: “No work order has gone to the vendor. Nothing is scheduled until he answers.” Then: “If Aaron had declined, or simply not answered, the vendor would never have heard from me.”

Human-in-the-loop approval controls that avoid approval fatigue

An approval only protects you if someone reads it. Anthropic says users accept 93% of the manual permission prompts in Claude Code, its coding tool, and that over time “people stop paying close attention to what they’re approving.” Researchers call the wider habit automation bias, “the tendency to over-rely on automation.”

So the goal is fewer requests, each one worth reading. Here’s how Dash keeps them rare:

• Work that stays in your conversation never asks.
• You can fix a draft without starting over. Reply “make it shorter” in the thread, and Dash re-drafts, then asks again.
• A routine you trust can stop asking. “Always approve this action” turns the prompt off for that tool, but it only sticks if you connected the tool or you’re an admin, and only when the tool has no designated approvers.
• A scheduled task runs a tool on its own only if a workspace admin turns that on for the task. Anyone else’s click approves that one run.

To decide when to stop asking for a given action, watch what people do with the requests. Airtable puts it this way: “a high unedited-approval rate means you can loosen the gate; frequent edits or rejections mean it’s catching real problems and should stay tight.”

Dash comes with these defaults already set. Add it to your workspace, connect one tool, and the first email it drafts waits for a person’s approval before it goes anywhere.