Approval is a gate. Recovery is a separate design.

Why it matters

An approval screen can show one proposed action while a resumed process later acts on changed state. A restart can also replay earlier steps. Treat the human decision, the execution and the confirmation as separate events that need to remain connected.

Read the evidence

LangGraph documents that interrupted nodes run again on resume and warns about side effects before an interrupt. Its pause-and-resume mechanism requires persistence and a thread identifier. OWASP’s Excessive Agency guidance separately emphasizes limiting functions, permissions and autonomy. Those controls address different parts of the problem.

How to use this resource

Proposed tabletop exercise: review a fictional record update without sending it to a real service. Follow the request through approval and failure paths.

• Show the reviewer the exact target, proposed change and supporting context.
• Tie approval to a specific payload; changed contents should require another decision.
• Define rejection, timeout and unavailable-reviewer behavior.
• Check how restart and retry affect each action, including duplicate protection.
• Verify the destination state and record the outcome separately from the approval.

Limits and evidence

This is a documentation-based design checklist, not a security certification or a tested integration. Permissions should be enforced by the underlying system, not just a prompt. No message, record, payment or external account was changed for this resource.

Put it to work.

• Bind approval to the exact action.
• Use the minimum required permissions.
• Check replay and duplicate behavior.
• Verify the actual destination state.

Go to the source.

Original material, with its own scope and publication date. This note is an explanation, not a CooScope performance test.

1. LangGraph — Interrupts, persistence requirements and replay behaviorLink / source review: 2026-10-04
2. OWASP — LLM06:2025 Excessive AgencyLink / source review: 2026-10-04