An agent that can refund, delete, email customers or change infrastructure needs a person in the loop for the risky steps. How to build approval gates that wait hours or days without paying for compute, with durable function callbacks, signed approval links, timeouts that default to no, and an audit trail.
The hard part of human approval used to be the waiting. A person might answer in two minutes or two days, and something had to hold the agent's state, wake it when the answer came and give up when it did not. Lambda durable functions make that a few lines: a callback suspends the function, costs nothing while suspended and resumes when an external system responds.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
The agent proposes an action as structured data (type, target, parameters, its reasoning) instead of calling the tool directly. Risky tools are not given to the agent at all.
A step validates the proposal against policy: is this user allowed to request it, is the amount within limits, does the target exist.
createCallback returns a callback ID. A step sends the approver a message, in Slack or email, with the proposal and approve and reject links that carry a signed, single-use token bound to that callback ID.
The function waits on the callback with a timeout. It is suspended and billed nothing while it waits.
The approval endpoint verifies the token and the approver's identity and permission, then calls SendDurableExecutionCallbackSuccess or SendDurableExecutionCallbackFailure with the decision.
The function resumes. On approval, a step performs the action with credentials scoped to that action alone. On rejection or timeout, it records the outcome and tells the requester.
Timeouts default to no. An approval nobody answered is a rejection, never an approval.
Show the approver exactly what will happen, rendered from the same structured proposal the executor will use, not from the model's description of it.
The approver must not be the requester for high-risk actions, and the approval link must not work for anyone else who sees it.
Put the action itself in a step, so a retry after a crash does not refund twice. Make the downstream call idempotent with a key derived from the proposal.
Record every proposal, decision, approver and result. The audit trail is the point as much as the gate.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
EKS and AI Agents: Running Agents on Kubernetes, and Letting Agents Operate Your Clusters
Two different problems. Running agents on EKS is about long-lived workers, GPUs, sandboxes for code they write, and tight egress. Letting an agent operate EKS, through the EKS MCP server or kubectl, is about read-only by default, separate roles for writes, and approvals. The setups that are safe enough to use.
Read
MCP in Production on AWS: Giving Agents Tools Without Giving Away the Keys
The Model Context Protocol made connecting agents to tools easy, which is exactly the problem. The risks that matter in production (tool output as an injection channel, over-broad tokens, unreviewed servers) and how Gateway, Identity and Policy on AgentCore, or your own controls, contain them.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.