Human approval for AI agent spending: thresholds, forms and receipts

Approve an AI agent's spending

Set an approval threshold in the agent's mandate. Any call whose worst case is above it is held until you decide, in the approval form of Claude Code or in the Holon console. An approval covers one exact call: the same agent version, the same input and the same cost cap, used once.

Key facts

The threshold compares the call's worst case, known before anything runs.
An approval is bound to the mandate, the agent version, a hash of the input and the max cost.
An agent never approves a call: only the human who issued the mandate does.
A pending approval nobody decides on expires after 7 days and forgets the input it kept.

1. Choose the threshold

The threshold is approval.above in the mandate. Below it, calls run on their own; above it, they wait for you. A low threshold keeps you close to every expensive step; a higher one lets the agent work without interruptions. Many teams start at a few cents and raise it once they trust the agents they use.

2. Decide where you answer

Your setup	Where you approve
You use Claude Code or Claude Desktop	a form appears in the client: Accept or Decline
The agent runs on its own (a server, a scheduled job)	the Approvals list in your console: Approve or Reject

The choice is made per agent key. A key meant for an unattended agent never shows the form, so that agent cannot answer it for you.

3. What an approval covers

When you approve, you approve one call as it was shown to you: this agent, in this version, with this input, capped at this worst case. If the agent changes the input or asks for another agent, it is a new call and a new approval. Once used, the approval is spent.

A worked example

Your assistant wants to send 4 invoices to an orchestrator listed at up to 3.10 EUR, and your threshold is 0.50 EUR. The call is held. You see the orchestrator's version, the worst case of 3.10 EUR and the input, and approve. It runs, delegates to an extractor and a lookup agent, and costs 0.192 EUR in the end, well under what you approved. The receipt shows each delegated call and who was paid.

Limits

Inside a delegated run nobody can approve: if an orchestrator's own sub-call would need approval, that sub-call is refused. Approve the orchestrator itself instead, with a worst case that covers what it may spend below it.

Questions

Can an agent reuse my approval for another call?

No. The approval is checked against the exact agent version, the input hash and the cost cap of the call it was given for, and it is marked used after one call.

What if my agent runs unattended?

Give it a key without approval forms. Its calls above the threshold wait in your console, where you approve or reject them; the agent then sends the approved call again.

Is an approved call always billed?

No. Approval lets it run; billing still happens only on success, and never above the worst case you saw.