Skip to content
Agentic WorkFlow

Action Approval & Untrusted Content

An agent in Agentic WorkFlow can read the live page. That is the whole point — but it is also the risk. Page content is untrusted input. A page can contain text written specifically to steer whatever model reads it. When that model’s output then drives a real action — a click, a form fill, an HTTP call — a hostile page gains an action primitive: a way to make the agent do something on its behalf.

Action approval is the safeguard. Any time a model’s decision would cause a side effect, the run pauses and shows you the concrete action before it happens. You approve or reject it. Nothing acts without your say-so.

The risk, concretely

Section titled “The risk, concretely”

Nodes like Get All Text, Get Accessibility Tree, and Get Structured Data feed page content straight into agents today. The approval gate ensures that even if a page tries to hijack the model, a person still stands between the model’s decision and the real-world action.

How the gate works

Section titled “How the gate works”
flowchart TB
  Page["Untrusted page content"] --> Model["Agent model"]
  Model -->|decides to act| Gate{"Approval gate"}
  Gate -->|you approve| Act["Action runs<br/>(click / request / MCP call)"]
  Gate -->|you reject / timeout| Deny["Action denied<br/>model told, continues without it"]

  style Gate fill:#fff3e0,stroke:#ef6c00
  style Act fill:#e8f5e9,stroke:#2e7d32
  style Deny fill:#fdecea,stroke:#c62828

  1. The model decides to act. During an agent run, the model calls one of its action tools (for example, Browser Tool or HTTP Request Tool).

  2. The run surfaces the concrete action. An approval row appears in the Executions pane naming exactly what will happen — “click the ‘Delete account’ button on example.com”, “send a POST request to api.example.com” — with the target host. It names the action, never secret values like passwords, headers, or request bodies.

  3. You decide. Approve and the action runs. Reject and it never runs — the model is told you declined and continues without it.

  4. Unattended runs fail safe. If no one responds within the timeout, the action is auto-rejected, so a scheduled or background run can never act without a human.

Two kinds of gate

Section titled “Two kinds of gate”

Agentic WorkFlow has two complementary “wait for a human” mechanisms. They solve different problems:

Live action gate (this page)Wait For Approval node
GatesEach model-driven action, mid-agentA whole step in the flow
Who triggers itThe model, when it calls an action toolYou, by placing the node in the graph
How long it waitsUntil you respond, or the timeout auto-rejectsIndefinitely — survives browser restarts
Where it livesInside the agent’s reasoning loopAs a node with Approved / Rejected outputs

Use Wait For Approval for a deliberate, durable checkpoint you design into a flow. Action approval is automatic and non-optional for the action tools — you don’t add it, it’s always there.

What this means for you

Section titled “What this means for you”
  • You are always in the loop for actions. An agent can read freely, but it cannot click, submit, call an API, or invoke a remote tool without your approval.
  • The gate can’t be turned off. There is no per-tool setting to skip it. For a trusted sequence you can choose Approve all remaining for this run — a visible, one-click choice you make during that run, not a hidden config.
  • Secrets stay hidden. Approval prompts name the action and host only; typed values, headers, bodies, and credentials never appear in the prompt or the logs.
Section titled “Related”