Our support agent approved a $2,400 fraud refund in 30 seconds

Our support agent approved a $2,400 fraud refund in 30 seconds. The customer's story was convincing, the documentation looked legitimate, and our agent had the authority to process refunds under $3,000. Everything worked exactly as designed.

The problem? The customer was a scammer with a fake receipt and a sob story optimized for AI empathy.

That's when we learned that approval gates aren't just about protecting your business from agent mistakes — they're about protecting it from people who've figured out how to manipulate your agents.

The Pattern That Saves You

Human-in-the-loop approval gates work, but only if you build them right. Most people add gates everywhere and create approval fatigue. The trick is routing by risk, not by task type.

Here's our approval matrix:

LOW_RISK = auto_approve
- Refunds under $50
- Standard FAQ responses  
- Appointment scheduling
- Password resets

MEDIUM_RISK = async_review
- Refunds $50-$500
- Policy exceptions
- Account modifications
- Bulk operations

HIGH_RISK = sync_approval
- Refunds over $500
- Data exports
- Account deletions
- Financial adjustments

The key insight: async review for medium-risk items. Your agent processes them immediately but flags them for human review within 24 hours. If something's wrong, you can reverse it. If it's fine, no action needed.

This prevents the approval bottleneck while catching the expensive mistakes.

Implementation That Actually Works

Don't build approval gates into your agent's decision tree. Build them into your business logic layer:

def process_refund(amount, reason, customer_id):
    risk_level = calculate_risk(amount, reason, customer_id)
    
    if risk_level == "LOW":
        return execute_refund(amount, customer_id)
    
    elif risk_level == "MEDIUM":
        refund_id = execute_refund(amount, customer_id)
        queue_for_review(refund_id, reason)
        return refund_id
    
    else:  # HIGH_RISK
        approval_id = request_approval(amount, reason, customer_id)
        return f"Approval requested: {approval_id}"

Your agent doesn't know about approval gates. It just calls process_refund() and handles the response. This keeps your agent logic clean and makes your approval rules easy to adjust.

The Risk Calculation That Matters

Amount thresholds are obvious. The subtle risk factors matter more:

• Customer history: New accounts get higher scrutiny
• Request patterns: Multiple similar requests flag for review
• Emotional language: Urgency and sob stories increase risk scores
• Documentation quality: Blurry receipts or missing order numbers trigger gates

Warning: Don't tell your agent about the risk calculation. Attackers can read your system prompts and craft requests to stay under your thresholds.

The Approval UX That Doesn't Suck

When your agent hits an approval gate, it needs to handle the wait gracefully:

"I've submitted your refund request for approval. Our team reviews these within 2 hours during business hours. I'll email you as soon as it's processed. Is there anything else I can help you with while we wait?"

Never leave customers hanging. Always give them a timeline and next steps.

The $2,400 fraud attempt taught us that approval gates aren't just about agent safety — they're about business security. Your agent is only as trustworthy as the approval system behind it.