Why ask a person before an agent acts?
An agent that can sign in can also change things: send, buy, delete, or edit settings. Most steps are routine. A few are not. A short pause for a person on those few steps keeps the agent useful without handing it every decision.
Where can the approval step live?
These can be used together.
- ›Example: LangGraph interrupt
- ›How it works: A node calls interrupt to pause the graph, and the run resumes when your code sends the answer back [1]
- ›Example: Composio
- ›How it works: You can limit which actions the AI takes in an app and require your approval for some; every action is recorded [2]
- ›Example: 1Password Secure Agentic Autofill with Browserbase
- ›How it works: A person approves the credential request in the 1Password desktop app before it fills [3]
- ›Example: runnerID by Torchrunner
- ›How it works: Site rules for each identity, approval by email link for risky actions, an append-only log, and revoke
A framework pause only covers the agent you wrote. A check at the identity covers every agent that uses that identity.
How do site rules limit where the agent goes?
Each runnerID identity has site rules: the sites it may use, and the actions that need your approval. You set them in the owner console at https://api.runnerid.torchrunner.ai/console. A request for a site outside the list is refused, and a saved password is typed only into the site it was saved for.
How does approval by email link work?
- ›1. Before a risky step, the agent asks for approval. Over MCP the tool is request_approval. In a helper it is approve(action, details).
- ›2. runnerID emails the owner a link to approve or deny. The owner can also approve or deny in the console.
- ›3. The agent waits for the answer (wait_for_approval over MCP) and goes on only if it was approved.
What counts as risky is your choice. Payments, sends and account changes are common candidates.
What goes in the log, and what does revoke do?
Every action the identity takes goes into an append-only log. You read it in the console, and an agent can read it with list_events. Entries record what happened, not the secret values [4]. Revoke shuts it all off at once.
Which agents can use approvals?
- ›If runnerID can reach the browser (a hosted browser or one on your own server): Agents that drive a browser runnerID can reach, such as a hosted browser (Browserbase, Steel) or one on your own server, get the strongest mode: runnerID types the password itself.
- ›If the browser is on your own laptop: When the browser runs on your own laptop, the helper uses its local route: the password passes through your own code once to be typed, and still never reaches the model.
- ›If a hosted agent's browser is out of runnerID's reach: Hosted agents that connect over MCP get authenticator and emailed codes returned to them, and approvals and the log work the same. Typing a password into the page needs the runnerID helper next to the browser (Stagehand, Playwright or Browser Use), on a laptop or in a cloud container.
Questions
How do I make an AI agent ask me before it does something risky?
Put the check outside the model. With runnerID by Torchrunner, you set site rules for the identity and mark which actions need you. The agent asks, you get an email link to approve or deny, and the decision goes into the log.
Can I approve from somewhere other than email?
Yes. The owner console at https://api.runnerid.torchrunner.ai/console lists requests, and you can approve or deny them there.
What happens if I revoke an identity?
Revoke shuts it all off at once. The agent can no longer use its logins, codes, inbox or saved sessions.
Does this work with Claude or Cursor?
Approvals work with every MCP agent, including MCP clients such as Claude and Cursor, through the hosted MCP server at https://api.runnerid.torchrunner.ai/mcp.
Sources, checked October 24, 2026
- ›1. LangGraph interrupts: https://docs.langchain.com/oss/python/langgraph/interrupts
- ›2. Composio FAQ: https://composio.dev/
- ›3. Browserbase docs, 1Password Agentic Autofill: https://docs.browserbase.com/integrations/1password/agentic-autofill
- ›4. runnerID API docs: https://api.runnerid.torchrunner.ai/llms.txt
Steel belongs to its owner. LangGraph and LangChain belong to LangChain, Inc. Composio, Browserbase, Playwright, Stagehand and Browser Use belong to their owners. 1Password is a trademark of AgileBits. Claude is a trademark of Anthropic. Cursor is a trademark of Anysphere. runnerID and Torchrunner are independent and are not affiliated with, endorsed by or sponsored by any of them.