Approval Required - AG2

Approval Required

approval_required() is a built-in tool middleware that gates tool execution on human approval. When the agent tries to call a tool decorated with this middleware, the user is prompted to approve or deny the call before it runs.

This is useful for tools that perform irreversible, expensive, or sensitive actions — sending emails, modifying databases, executing payments, or deleting resources.

Quick start

 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25  ```
import asyncio
from autogen.beta import Agent, tool
from autogen.beta.config import OpenAIConfig
from autogen.beta.middleware import approval_required
@tool(
middleware=[approval_required()],
){

def delete_account(user_id: str) -> str:
"""Deletes a user account by ID permanently."""
return f"Account {user_id} deleted."
agent = Agent(
"assistant",
config=OpenAIConfig("gpt-4o-mini"),
tools=[delete_account],
hitl_hook=lambda event: input(event.content),
)
async def main() -> None:
reply = await agent.ask("Delete the account for user abc-123.")
print(await reply.content())
asyncio.run(main())
```


`<br> 1<br> 2<br> 3<br> 4<br> 5<br> 6<br> 7<br> 8<br> 9<br>10<br>11<br>12<br>13<br>14<br>15<br>16<br>17<br>18<br>19<br>20<br>21<br>22<br>23<br>24<br>25<br>`	``` import asyncio from autogen.beta import Agent, tool from autogen.beta.config import OpenAIConfig from autogen.beta.middleware import approval_required @tool( middleware=[approval_required()], ){
def delete_account(user_id: str) -> str: """Deletes a user account by ID permanently.""" return f"Account {user_id} deleted." agent = Agent( "assistant", config=OpenAIConfig("gpt-4o-mini"), tools=[delete_account], hitl_hook=lambda event: input(event.content), ) async def main() -> None: reply = await agent.ask("Delete the account for user abc-123.") print(await reply.content()) asyncio.run(main()) ```

When the agent calls delete_account, the user sees:

Agent tries to call tool:
`delete_account`, {"user_id": "abc-123"}
Please approve or deny this request.
Y/N?

Typing y lets the tool run. Any other input denies it — the agent receives the denied message and can adjust.

Note

approval_required() relies on the agent's hitl_hook to collect user input. If no hitl_hook is configured, context.input() will raise an error at runtime. Read more about Human in the Loop to learn how to configure a HITL hook.

Customizing the prompt

Override the message parameter to tailor the approval prompt:


`<br>1<br>2<br>3<br>4<br>5<br>6<br>7<br>8<br>9<br>`	<br>@tool(<br> middleware=[approval_required(<br> message="⚠️ The agent wants to run `{tool_name}` with {tool_arguments}. Allow? (y/n)",<br> denied_message="Operation blocked by user.",<br> )],<br>)<br>def send_email(to: str, subject: str, body: str) -> str:<br> """Send an email to the given address."""<br> return f"Email sent to {to}."<br>