Staged Actions: AI Agents That Ask Before They Act

Keeping a human in the loop for AI agent actions means the agent proposes rather than executes. In Mickai, every consequential action is staged as a request, the approver reads the operation in full, and a named seat approves or refuses it before anything runs. That decision is written into the Open Audit Record, so an action that ran traces back to the person who released it. Undoing one is itself a staged action.

• Consequential actions are staged, not executed. The agent produces a proposal, a person produces the outcome.
• The approver reads the operation itself, payload included, rather than a summary of it.
• The approval or refusal is a record in its own right: who decided, what they saw and when.
• Every staged action and decision is sealed into the Open Audit Record: append-only, hash-chained, tamper-evident.
• Entries are signed with FIPS 204 ML-DSA and verify cold and offline with the operator public key alone.
• Reversal is a new staged action. History is never rewritten to hide a mistake.

What is a staged action?

A staged action is a consequential operation the system will not perform on its own. The agent assembles it in full: the typed action, the target, the payload it would send, the studio that raised it and the reasoning behind it. Then it waits.

Nothing is hidden behind a summary. The approver reads the operation that will run, payload and all, and approval releases that operation and nothing else. What executes is what was reviewed.

The boundary is drawn by class, not by confidence. An agent does not get to decide that a given instruction, message or record change is routine enough to send by itself. If the class is consequential, it stages.

Why do AI agents need approval before they act?

Regulated teams are used to being wrong. Underwriting is wrong sometimes, so is triage, so is a first draft. Existing controls assume error and catch it through review and sign-off, and each assumes time passes between a decision and its effect.

Agentic systems collapse that gap. An agent holding credentials can send the message, move the record and notify the counterparty without pausing in between. The error is ordinary. The missing pause makes it unrecoverable: by the time a person sees it, the outside world has responded.

Staging puts the gap back deliberately. The agent keeps its pace for work that is cheap to redo, and gives that pace up where an action leaves the building.

Can an AI agent action be undone once it has run?

Most of the time there is nothing to undo, because the action never ran. A refused proposal is recorded as refused and the underlying system is untouched. Refusal is the cheapest correction there is.

When an action did run and proves wrong, the corrective step is itself staged: proposed, approved and recorded like the original. Both entries sit in the same chain, in order.

Some effects cannot be recalled. An instruction that reached a counterparty is out, whatever the system does next. That is why the control sits before execution, and why the record is append-only: an entry cannot be removed or rewritten without breaking the chain.

What does the approver see before deciding?

The approver sees the operation itself: the typed action, the target and the payload that would be sent, in the form it would be sent. A SHA-256 of that payload is recorded with the decision, and the hash binds the approved operation to the executed one, so the two can be matched later rather than taken on trust.

It also carries provenance: which studio raised it, which brains and documents informed it, and which figures the deterministic engines produced. Identical inputs give identical results, so an auditor can rerun the calculation later and get the same number, not a similar one.

And it carries identity. Identity is issued, not federated, each organisation holding its own signing key and ledger, so an approval attaches to a named seat rather than a shared account. Seats grant or revoke studios individually.

How do staged actions hold up in an audit?

A regulator or an internal auditor rarely asks whether the model was clever. They ask who authorised this, on what basis, and whether it can be shown. Staging makes the answer a record, not a reconstruction.

Each entry carries index, timestamp, actor, typed action, target and a SHA-256 of its payload, signed with FIPS 204 ML-DSA, the post-quantum signature standard. Verification needs the operator public key alone, cold and offline. Signed checkpoints written off the box, with anti-rollback, make truncation detectable, a property that rests on custody of the signing key.

The system runs on hardware the customer owns, over loopback only, with no outbound path by default. The evidence stays where the work happened, and there is no portal and no vendor to ask.

Does human approval make AI agents too slow to be useful?

No, because staging is scoped to consequential classes. Reading, searching, summarising, drafting and modelling run without interruption, and that is where most of the hours go.

What changes is the final step. The proposal arrives complete, so the reviewer reads an assembled operation rather than building one. Its pace is set by the approver, not the agent: a proposal nobody picks up waits, and waiting is the safe state.

The trade is plain. Staging costs one review by a person already accountable for the action. An action that left the building unreviewed costs a remediation instead.

Frequently asked questions

Can I let the agent act without approval for low-risk work?

Yes. The boundary is set by action class, so routine and easily reversible work runs without interruption while consequential classes always stage. What an organisation cannot do is let the agent decide for itself that a consequential action feels low risk today.

What happens if nobody approves a staged action?

Nothing executes. A proposal that is never approved does not run, and the fact it was raised is still recorded. Silence is treated as refusal, not consent, so an unattended queue is safe by default.

How do I prove months later that a person, not the agent, authorised something?

Read the record. The approval entry names the actor, the typed action and the target, and carries a SHA-256 of the payload, all signed. Anyone holding the operator public key can verify it cold and offline.

Can a staged action be changed after it is approved?

No. Approval releases the exact operation reviewed, and the recorded hash of the payload shows the executed operation to be that same one. If it needs to change, it becomes a new proposal with its own approval and entry.

Where can I see staged actions working end to end?

Staged actions sit inside the wider system rather than beside it, so the clearest way to judge them is to watch one proposal, one decision and one record in the same place. A selective closed beta is open for applications at mickai.co.uk/beta, and not every applicant is accepted.