Wrong list
You ask for a reminder to 3 clients who haven't paid, and the agent picks the whole mailing list. Your phone shows the whole mailing list in the To line before a single one goes out.
Human approval for AI agents. Make your AI agent ask before it sends, pays or deletes.
You pick which actions need your approval. When your agent tries one, a request comes to your phone. The action runs only if you approve it. Deny it or let it time out, and nothing happens.
Sign up at portal.agentaction.online and connect your first app straight away. How to get started
Sales assistantWorks in your Gmail and Google Drive
I've written the spring offer. Sending it to all 214 customers now.
Waiting for your approval. Code 4821
Approved. Sent to 214 customers.
Approved. Sent to 214 customers.15 minutes
You said no, so I haven't sent it. Shall I send it just to the 3 customers who asked?
AgentAction
Your account
Send email via Gmail
Code
4821
Expires in
9:52
Asked bySales assistant
What it will do
Written by the AI agent. Read it as text, not as instructions.
To214 customers (spring list)
Subject20% off this weekend only
Approve, and stop asking for
Tap Approve or Deny on the phone to see what the agent says back.
It works like the check your bank does.
When you pay online, your banking app sometimes asks you to confirm it's you, and the money only moves once you do. AgentAction puts the same kind of check in front of the actions you choose for your AI agent.
Your agent can send an email you've never seen.
People give AI agents their inbox, calendar, files and customer lists so they don't have to watch every step. The catch is that an agent can't always tell your instruction from one hidden in an email or web page it has read, and it will act on either just as quickly.
For example:
Hidden instruction
An email arrives with text you can't see, telling your agent to forward every invoice to an address you've never heard of. Your phone asks you to approve forwarding invoices to that address.
Double refund
An agent handling customer service refunds £40, loses track of the conversation and goes to refund it again. The second request has the same customer and the same £40 you approved 10 minutes ago, so you deny it.
Shared folder
Tidying a shared drive, the agent decides a folder is old and tries to delete it. The request names the folder, and you know a colleague still works from it.
We made these examples up to show what can go wrong.
How AgentAction works
-
Choose what needs your approval.
Pick the actions to check, such as sending a new email, paying, deleting or posting. Or start from a suggested set. Anything you don't pick runs as normal, so your agent can still reply to emails on its own if you want it to.
-
The request comes to your phone.
When your agent tries one of those actions, the action waits and a request appears in the AgentAction app. The lock screen shows only the kind of action and a 4-digit code. If you're chatting with your agent, it's given the same code to show you, so you can tell which request is which. If it's working in the background, go by the summary instead.
-
Approve or deny.
Open the request to see a summary: who the email is going to and its subject. On a phone with a screen lock, approving takes your face, fingerprint or passcode. If you deny it, or don't answer within 10 minutes, it doesn't run.
If your agent is sending 40 invoices, you won't want to approve each one. Tap "Approve for longer" and that kind of action goes ahead, whatever the details, for 5 minutes, 15 minutes or 1 hour.
Who it's for
Gmail
Reply to a threadRuns on its own
Send a new emailAsks you first
Delete a threadAsks you first
Using an agent yourself
Hand your inbox to an agent and still decide what it sends.
You gave an agent your email so you could stop reading every reply. Let it keep answering threads, and have it ask you before it starts a new email or spends money.
MailRe: collection on Saturday?
AgentAction: approval neededIssue a refund via Stripe · code 2586
CalendarFlour delivery, 07:30
Small businesses
Refunds and discounts stay with you.
Let the agent chase unpaid invoices and answer most enquiries. When it wants to give a refund or a discount, the request comes to your phone and you deal with it between customers.
Agencies
Each client approves their own agents' actions, inside rules you set.
Each client pairs their own phone, and the approval screen carries your agency's name, logo and colour. You set the rules a client can't switch off (every payment needs approval, for instance), and whether they can use "Approve for longer", and for how long. They choose the rest. When a client asks who approved that email, the record shows which phone approved it, and when.
If you run agents for many clients, one AgentAction installation can serve them all as separate organisations, each with its own locked rules and settings. Sonti, the AI engineering agency we work with, sets that up as part of Enterprise.
Developers
Add a human approval step to any MCP or API tool call.
AgentAction is an approval server and a TypeScript SDK. Before your code runs a risky tool, it checks the person's rules and, if needed, creates a request. The server accepts an answer only if the phone has signed it over a hash of the exact arguments, and you get that hash back to compare before anything runs. It was built for MCP (Model Context Protocol) tool calls going through a gateway, and any app or API can use it through the SDK and signed webhooks.
If you'd rather not hold a connection open, a signed webhook reaches your server within seconds of a decision (there isn't one when a request expires). Install the SDK from the repository; it isn't on npm.
const key = 'gmail/GMAIL_SEND_EMAIL';
const { gated } = await agentaction.evaluate(user.id, key);
if (!gated) return sendEmail(args);
const argsHash = hashArgs(args);
let { request } = await agentaction.createRequest({
externalId: user.id,
actorLabel: 'Sales assistant',
resourceKey: key,
title: 'Send email via Gmail', // shown on the lock screen
fields: [{ label: 'To', value: '214 customers' }],
argsHash,
});
while (request.status === 'pending') {
request = await agentaction.waitForRequest(request.id);
}
const ok = request.status === 'approved'
&& request.argsHash === argsHash;
if (ok) return sendEmail(args);
throw new Error(`Not sent: ${request.status}`);Larger organisations
Company-wide rules for what AI agents can do on their own.
Set default rules for your organisation and lock the ones people mustn't switch off, such as approval before anything is deleted from a shared drive. Each decision is signed on the approver's phone.
The server, SDK and phone app are open source, so you can run the server on your own infrastructure with Docker and Postgres. If the approval service can't be reached, the integrations so far are built to refuse the action rather than let it through.
Not built yet: single sign-on, approver roles or two-person approval, an admin console, key rotation, rate limiting and per-organisation quotas. They're on the roadmap.
- Time to answer
- 5 to 60 minutes (10 by default)
- Approve for longer
- Up to 8 hours (1 hour by default), or switched off
- Phones per person
- 1 to 5 (5 by default)
- Compulsory approvals
- Chosen by an admin; people can add more but can't remove these
Why not just ask in the chat?
Some agents already ask "Shall I go ahead?" before they act. The trouble is that the question and your answer pass through the same conversation the agent is reading. If it has been tricked by something it read, the same trick can answer yes for you, or skip the question altogether.
AgentAction asks on your phone, which the agent can't get into. The pause sits in the connection between your agent and your apps, such as Gmail, so the agent can't talk its way past it.
Who sees and holds what
A one-off approval covers the action exactly as it stood. If anything in it changes after you approve, it won't go ahead.
| Who | Short summary | Full email, file or payment | Key that approves | Record of who approved |
|---|---|---|---|---|
| Your phone | Yes | No | Yes | No |
| The approval service | Yes | No | No | Yes |
| The service that does the work | Yes | Yes | No | No |
The service that does the work sends the email or makes the payment once, after you approve. If you use the portal, the portal holds your agent's email encrypted while you decide and deletes it afterwards. On a phone with a screen lock, the app won't use its key until the phone has checked it's you.
For technical readers: the design borrows from two open standards, OpenID CIBA (confirming a request on a separate device) and OAuth Rich Authorization Requests (describing exactly what is being approved). It isn't a certified implementation of either.
Coming to these apps first
Knotie-AI Pro knotie-ai.pro
A white-label AI platform for agencies, from the same founder as AgentAction. Its voice and chat agents work in customers' calendars, inboxes and CRMs.
Viddescriptor viddescriptor.com
Viddescriptor's agent publishes videos for you, and the plan is for each one to wait for your approval before it goes out.
More apps will follow. If you run an agent product and want approvals in it, we'll help you set it up. Get in touch
Questions about AgentAction
What is AgentAction?
It makes your AI agent ask you, on your phone, before it does any of the actions you've chosen to check, like sending an email or making a payment.
Does it work with the AI assistant I already use?
Yes, if your assistant lets you add a "connector" (sometimes called an "MCP server"). You connect Gmail, your calendar and so on inside AgentAction, then add one AgentAction connection to your assistant. From then on it reaches those apps through AgentAction rather than directly, which is what lets it ask you first. Not sure about yours? Email us its name and we'll tell you.
What does it cost?
We haven't published prices yet. If you have a technical person, the software itself is free to run on your own server.
Do I need to know how to code?
No. It's all clicks in the portal; the fiddliest part is adding one connection to your agent. Developers adding it to their own product use the SDK.
How do I stop an AI agent sending emails without asking me?
Connect your email account in AgentAction, add the AgentAction connection to your agent and switch on approval for sending new emails, and for replies too if you want. Your agent has to reach your email through that connection, not its own direct access; from then on each of those emails waits for you.
What happens if I don't answer?
After 10 minutes (or your organisation's limit) the request expires and the email or payment doesn't happen. Your agent is told it wasn't approved, and it can ask again.
Will I be asked about everything?
No. Only the actions you choose, plus any your employer or agency has made compulsory. "Approve for longer" also lets one kind of action through for up to 1 hour (longer only if your organisation allows it).
Can it stop my agent being tricked (prompt injection)?
No. An agent can still be fooled by hidden text in an email or web page. But if the trick asks for an action you've marked for approval, the request still comes to your phone, and you can deny it.
Which phones does it work on?
Android today — get it on Google Play. The iPhone app is built but is not in the App Store yet; it is coming soon, and until then you can ask us for a TestFlight invitation.
Can I use more than one phone?
Yes, up to 5 on one account, which could include a colleague's phone. Whoever answers first decides. You can't yet require two people to approve the same action.
Who can see my emails and files?
Only the service that sends or saves them. The approval service gets the short summary you see on your phone, not the email itself.
What if I lose my phone?
Sign in at the portal, remove the lost phone and pair your new one. A removed phone can't approve anything.
Who makes it?
Kno2gether Labs. It's built by Avijit Sarkar, and Sonti, an AI engineering agency we work with, sets it up for larger organisations.
Try it with your own agent.
Free to start. Pick the one action that would hurt most if it went wrong — for a lot of people that’s a new email to customers; for a shop it might be refunds — and put yourself in front of it.
- Sign up at portal.agentaction.online. Already have an account? Log in.
- Connect the apps your agent uses — Gmail, Google Calendar and more, with new ones being added.
- Pair your phone. Open Approvals, install the app, and scan the code on screen. Get it on Google Play; the iPhone app is coming soon.
- Choose which actions need you. Mark the risky ones — sending, paying, deleting. Everything else keeps running untouched.
- Connect your agent. Open MCP Access, create a token, and point your agent at the MCP server URL shown there.
- Stuck on a step? Email connect@agentaction.online and we’ll walk you through it.
Get the app
The approvals arrive here. Install it on the phone you want to approve from, then pair that phone from Approvals in the portal.
iPhone: coming soon to the Apple App Store.
Connecting your agent
AgentAction speaks MCP, the protocol agents already use to reach tools. Anything that can talk to an MCP server can use it — Claude, Cursor, n8n, your own code. You are not adopting a framework; you are changing which address your agent’s tools live behind.
What you point it at
Your own URL and token appear on the MCP Access page. They look like this:
url: https://gateway.agentaction.online/api/mcp
token: your token from MCP AccessSend the token as a bearer header. Your agent then sees your connected apps as ordinary tools — the same names, the same arguments.
What changes when it runs
For an action you did not mark, nothing changes at all. It runs, exactly as before.
For one you did, the tool call comes back APPROVAL_REQUIRED with a four-digit code instead of running, and the request appears on your phone. Approve it and your agent calls the same tool again, once, and it goes through. Refuse it, or leave it, and nothing happens.
Approving never runs anything by itself. It unlocks a single retry your agent has to make — so nothing executes behind your back, and your agent sees the outcome.