UiPath's Cliff Simpkins Proposes 'Approval Object' Pattern: Preventing AI Agents from Altering Parameters After Human Approval
Cliff Simpkins of UiPath argues that many current 'human-in-the-loop' mechanisms for AI agents are insecure because approval records are not bound to execution parameters. He proposes the 'approval object' pattern, treating approvals as immutable first-class artifacts and enforcing tool-side verification to mitigate prompt injection and state drift risks.
ImportanceMaterialEvidenceE3 inspectableWrite-upQuick
When your AI agent requests a $5,000 wire transfer to Vendor Y, the manager clicks 'approve' in Slack, but the agent subsequently replans and decides to send $50,000, traditional 'human-in-the-loop' (HITL) mechanisms fail. In a blog post dated October 6, 2026, Cliff Simpkins, Senior Director of Developer Relations at UiPath, identifies this 'approval theatre' as a default flaw in most agent frameworks: the approval is merely a string or chat log, while the agent's internal state remains mutable before execution.
Simpkins proposes the 'approval object' as the solution. This is an immutable record containing the action type, exact parameters, risk level, approver identity, and timestamp. Crucially, the execution tool must re-fetch this record and validate it against the parameters it is about to send before acting. If the agent replans its parameters after the human said 'yes,' the check fails, the tool refuses to execute, and the attempt is logged.
This pattern shifts the trust boundary from vulnerable agent memory to the orchestrator's record. Simpkins emphasizes that this is not just a technical best practice but a compliance measure against Article 12 of the EU AI Act, which requires automatic logs for high-risk AI systems. By embedding verification logic in the tool rather than the agent framework, the system 'fails closed,' blocking irreversible operations without a valid approval object and thereby resisting prompt injection attacks.