Skip to content
TechTipsEasy Find a guide

AI productivity

Build n8n AI workflows with approval before action

Design n8n AI workflows that draft, pause, request approval and only then take external action, with safer nodes, credentials and audit habits in production.

By TechTipsEasy · · 4 min read

Approval is the product feature

An AI workflow that drafts a message is helpful. An AI workflow that sends, deletes, buys or changes records without review can become a liability. n8n is built for connecting apps and automating workflows, and its documentation describes AI and business-process automation together. That combination is powerful precisely because it can touch real systems. For any workflow with external consequences, make human approval a first-class step, not an afterthought.

Use pause points deliberately

The n8n Wait node documentation explains that a workflow can pause and resume later based on time, a webhook call or a submitted form. This is the basic building block for approval. The model can classify, summarize and draft. The workflow can package the proposed action. A human can approve, reject or edit. Only after approval should the workflow call the external system.

Simple approval pattern

  1. Trigger receives an event, such as a new support ticket.
  2. AI node drafts a suggested action and confidence note.
  3. Workflow builds an approval payload: original input, proposed action, affected account, risk label and links.
  4. Wait or form step pauses for reviewer input.
  5. Approved path performs the action with limited credentials.
  6. Rejected path stores feedback and stops.
  7. Execution log records who approved and what changed.

For reviewer input, the n8n Form node documentation covers user-facing forms. Forms are useful when approval needs more than a yes button, such as choosing a category or editing a short message.

Concrete example

Imagine an AI workflow that handles refund requests. The agent reads a ticket and order metadata, then drafts one of three recommendations: approve refund, ask for more information or escalate. The approval screen shows the customer's request, order age, refund amount, policy snippets and the suggested reply. If the reviewer approves, n8n sends the reply or creates a task for the finance system. If the reviewer edits the response, the edited text becomes the source of truth. The AI recommendation is evidence, not authority.

Protect the action side

Anthropic's prompt-injection mitigation guide recommends least privilege and careful handling of untrusted content. Apply that to n8n credentials and nodes. A workflow that only needs to create draft records should not have delete permissions. A workflow that sends customer emails should use an account scoped for that purpose. If a node supports a simple approval operation, use it for simple cases; for complex approvals, keep the Wait or Form pattern explicit so reviewers see enough context.

Problems to check

  • Approval theater: reviewers see a vague summary but not the source data or exact proposed action.
  • Credential overreach: the approved path uses credentials that can do more than the workflow requires.
  • Hidden prompt injection: ticket text includes instructions to bypass review, and the workflow treats it as policy.
  • No rejection path: disapproved actions vanish without feedback, so the same bad draft recurs.
  • Unclear ownership: nobody knows who is allowed to approve risky actions.

Next steps

Pick one workflow with external consequences. Insert an approval step before the first write action. Show the reviewer the original input, generated proposal, exact target system, exact record and possible side effects. Limit credentials, log decisions and test with hostile input. The approved call should match the action the reviewer saw, and the log should let you verify that match afterward.

Reviewer experience

Approval screens should be short but complete. Show the exact action, target account, generated message or change, confidence note, source links and buttons for approve, reject and edit. Avoid making reviewers open five systems to understand risk. If approval is painful, people rubber-stamp. If it is clear, human oversight becomes real instead of ceremonial.

Dry-run first

Before enabling the approved path, run the workflow in dry-run mode. Store the action that would have happened, the approver response and the payload sent to the external system. Review ten executions. Only enable writes after the team agrees the approval screen contains enough context.

Use n8n's native review connector for agent tools

The current human review guide describes a tool-specific gate. Open the AI Agent's Tools panel, add a Human review step, configure a review channel, and connect the tools that need approval to that step. Approval executes the proposed call; denial cancels it. A separate Wait or Form path is useful for a custom process, but it only protects the action if the workflow routes every write through it.

For an email draft, show the sender, every To/Cc/Bcc address, subject, complete body and attachments. Bind approval to that exact payload. If the model edits the message or recipients afterward, require a new review. Also define what happens if nobody responds: the action stays pending or expires without sending. Test denial and timeout before trying the approved path with real accounts.

Sources and further reading

Documentation checked October 4, 2026. Product features and availability can change.

Keep learning