Implementing Human-in-the-Loop Approval for LangGraph Agents to Support FINRA Supervision

Approval is a control with an evidentiary output

Teams often build approval as a user interface step: the agent stops, a person clicks a button, the agent continues. That satisfies the mechanics of a pause but not the purpose. A supervisory process has to show that review happened, who performed it, and what it covered.

FINRA states that its rules are technology neutral and apply when member firms use generative AI, including tools built in-house and third-party or embedded features. Under Rule 3110, a firm must have a reasonably designed supervisory system tailored to its business. The 2026 oversight report says GenAI use can implicate supervision, communications, recordkeeping and fair dealing. It lists prompt and output logs, model version tracking, and human-in-the-loop review of outputs among possible controls. FINRA's agent material also names agents acting without human validation and approval as a consideration, and lists deciding where to place human oversight.

For outbound retail communications, FINRA's communications rules guide describes approval by an appropriately qualified registered principal before the earlier of use or filing, with records that include the principal's name, CRD number and approval date. Final responsibility for supervision stays with the member firm. An approval gate is a tool for meeting that responsibility, and no implementation by itself satisfies FINRA rules. Status is described as of November 2026.

Decide what needs approval with a risk-tiered model

Routing every action to a human produces consent fatigue, where habitual approval replaces careful consideration. NIST's agent identity tenets address this directly. They say organizations should define risk thresholds that initiate human review, route escalations to the correct authority, and include enough context for the reviewer to decide.

A practical model uses a small number of tiers, each documented with an owner and a rationale for where the gate sits. Document who approved the thresholds themselves, because that is the first question a reviewer will ask.

• Tier 0: automatic: Read-only retrieval from approved internal sources with no external effect. Execute and record.
• Tier 1: sampled review: Low-impact outputs such as internal summaries. Execute, then route a sample to review.
• Tier 2: pre-approval: Drafted client-facing communications and tool calls that change records or send data outside the firm.
• Tier 3: qualified approver: Actions that require a registered principal, such as retail communication approval.
• Tier 4: prohibited: Actions the agent must never take. Block without escalation.

Implement the gate with LangGraph pause and resume

LangGraph provides interrupts to pause a run, a checkpointer to persist graph state, and a way to resume with a value supplied by a human. Those primitives handle pausing. The decisions around them, such as which actions are gated, who may approve and what is stored, are yours to design.

Place the gate on the path to the side effect, not in the model's reasoning step. The interrupt should sit in a node directly upstream of the tool-executing node, so that no route through the graph reaches the tool without passing it. The interrupt payload should carry the proposed tool name, exact arguments, draft content, risk tier and the context a reviewer needs.

Handle three outcomes explicitly. On approval, the executing node should confirm the approved payload matches what it is about to run, for example by comparing a hash. On rejection, route to a node that records the decision and rationale and either ends the run or returns control to the agent with the reason. On edit, treat the reviewer's version as a new proposal: keep both the original and the edited content, and re-run any validation before execution.

Timeouts need a defined default. An unanswered request should expire without executing, be recorded as expired, and escalate to an alternate approver if the tier requires it. Because state is checkpointed, a paused run can wait for a human without holding a process open.

• Interrupt in a node placed directly before each Tier 2 and Tier 3 tool node
• Payload includes tool, arguments, draft, tier and reviewer context
• Resume value carries decision, edits and rationale, tied to an authenticated approver
• Executing node verifies the approved payload before running
• Rejection and expiry are recorded paths, not silent exits

Limits of in-graph approval and where execution-path enforcement fits

Approval logic inside a graph is only as strong as the graph. A new route, a different agent, a tool called outside the graph, or a third-party agent can skip the interrupt. Each team can also implement tiers and records differently, which makes consistency hard to demonstrate. And if evidence lives only in application state, its retention depends on each application.

Enforcement in the execution path addresses a different layer. NIST's tenet states that without enforced human-in-the-loop triggers for sensitive actions, a malfunctioning, hallucinating or manipulated agent could execute irreversible damage. Placing the control where calls actually happen means a tool call is evaluated whether or not the agent's graph asked for review.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers. For individual interactions and tool calls it can allow, redact, block, rate limit or escalate for human approval. Enforcement is at runtime, not reviewed after the fact, and it generates audit-ready evidence as a by-product. It can be deployed self-managed in the customer cloud, with configurable retention and data residency. Its scope is individual interactions and tool calls, not end-to-end tracing of agentic workflows.

The two layers complement each other. In-graph gates give reviewers workflow context and a good experience. Execution-path enforcement gives consistency across agents and a control that application code cannot route around. Examiner scrutiny and model risk management both favor being able to show that the second layer exists.

Test and govern the gate

A gate that has not been tested for bypass is an assumption. Write tests that attempt to reach each gated tool through every graph path, through alternate agents, and with modified arguments after approval. Then operate the gate as a governed control.

• Document why each gate sits where it does, and keep the oversight design within your model risk management framework
• Monitor approval rates and review time per approver to detect habitual approval
• Maintain a mapping of approvers to qualifications, with effective dates, and review it on a schedule
• Apply least privilege, multi-factor authentication and access reviews to human and non-human accounts
• Include third-party and embedded agents in the approval inventory, not only those you built
• Rehearse producing a full record for a sample action: proposal, decision, rationale and execution