Human-in-the-loop approvals
The agent pauses before any test that could change data or disrupt a service, and waits for you to approve or reject it.
Overview
PENOPS's agents test autonomously, but not without limits. Before the agent builds or runs a test, or sends an attack prompt to an LLM target, PENOPS checks the planned action against the target's guardrails. Detection and minimal proof run on their own. When an action would trip a guardrail, the agent pauses and asks you.
You approve once, approve for the rest of the scan, or reject. Nothing gated runs until someone with the right permission decides.
Why the agent pauses
Every target starts with two built-in guardrails:
| Guardrail | What it covers |
|---|---|
| Destructive change | Deleting or modifying existing target data, files, accounts or configuration. |
| Service disruption | Denial of service, resource exhaustion and unbounded fuzzing. |
Both ask a person before going ahead. Guardrails you add yourself also ask. When an action trips more than one guardrail, the most restrictive one applies.
A guardrail you switch off for a target no longer pauses the agent there. You manage guardrails in the Agent Profile.
Find work waiting on you
- Open Pentests > Targets. The Need action tile counts targets where the agent is paused, and AI proposals counts the open requests.
- Look for target rows with a blue dot titled Approval required, or filter Status to awaiting.
- Select the target. In the Missions tab, open a mission under Needs approval.
Decide an approval
- Open the mission and scroll to the approval card (the blue shield icon).
- Read the request title and the reason. If no reason is given, the card reads The agent needs your sign-off before proceeding with this test. For an LLM attack, the prompt the agent wants to send is shown above the card.
- If you need more detail, open the earlier Show the test and its output sections.
- Optionally, type guidance for the agent in Add context for an approval (optional). This field is not shown for LLM attacks.
- Click Approve, Approve + session or Reject.
The card changes to the decided state and shows who decided and when.
| Choice | What happens |
|---|---|
| Approve | Runs this test once. The agent asks again the next time it plans a gated action. |
| Approve + session | Runs this test, and automatically approves later gated tests on the same endpoints (the same host and path prefix) for the rest of this scan run. It does not cover other endpoints on the target, later scans, or your sign-in session. On an LLM target, each approval covers only the prompt on the card (see below). |
| Reject | Drops this hypothesis. The agent does not build or run the test. Any note you typed is ignored. |
Once an approval is decided, it cannot be changed.
What happens after you decide
- Web and cloud tests: when you answer the last open approval in a scan, that scan resumes on its own.
- LLM attacks: each approval covers the one prompt shown on the card. An approved attack is queued for a follow-up run, shown in the mission's history as Approval follow-up. If the follow-up cannot run after a few tries, the approval comes back for a new decision.
- Notes: when the scan resumes, a review agent checks your note. If it accepts the note, your guidance is folded into the test and your choice stands. If it declines the note, the approval returns to pending and you decide again. While the note is waiting for review, the card shows Answered.
A decided card shows Approved, Approved for session, Rejected, Expired or Answered, with the name or email of the person who decided and the time.
Rules and limits
- Expiry: a request with no answer within 14 days counts as rejected and stops counting toward Need action and AI proposals. On an LLM target the card then reads Expired; on other targets it can still look pending in the thread.
- Who can decide: anyone with Pentest > Targets: Write. Without it, the choice buttons are disabled.
- Who is recorded: PENOPS records the person signed in when the decision is made.
- One target, several requests: a target can hold more than one open request; AI proposals counts each one.
Good to know
- If an approval you already answered shows as pending again, the review agent declined your note. The card does not show the reviewer's reason. Decide again, with a clearer note or none.
- Your decision appears immediately. If it could not be saved, it rolls back and you see an error saying the decision was not filed.
- To stop the agent asking about a kind of action on one target, switch off or edit the guardrail in the Agent Profile. To make it ask about something new, add a guardrail.