# Human-in-the-loop pentesting: approval rules for AI agents

Source: https://aipentestservices.com/guides/human-in-the-loop-pentesting/
Publisher: Excession Labs (aipentestservices.com)
Last updated: 2026-11-09

Human-in-the-loop pentesting: set allow, ask and deny rules for an AI agent, decide which actions need approval, and where people review. Includes a rule table.

> **Short answer:** Human-in-the-loop pentesting puts people at fixed points in an AI-run test. Each tool gets a rule: allow (runs alone), ask (waits for approval) or deny (blocked). Humans set scope and rules before the test, approve risky actions during it, and check the evidence for each finding before the report. A rule table you can adapt is included.

Human-in-the-loop pentesting means that people hold fixed control points in a test run by an AI agent. They set the scope and tool rules before the test, approve risky actions during it, and check each finding before it reaches the report. The agent does the repetitive work. People keep the decisions that carry risk.

## Why does an AI pentest agent need human control points?

An agent acts on its own reading of responses, so it can take a harmful action that it thought was safe. OWASP names this class of risk in its LLM list. The 2026 edition lists Excessive Agency as LLM03: a system that can take damaging actions on unexpected, ambiguous or manipulated model output.

A pentest agent has real tools. It can send requests, run scripts and submit forms. A wrong guess against a live system can delete data, send email or spend money on a paid API. Control points limit what a wrong guess can do.

## What are allow, ask and deny rules?

Each tool in Incursion has a rule, and the operator sets the rules. The three values are:

- Allow: the tool runs on its own.
- Ask: the tool waits for a person to approve the exact call.
- Deny: the tool is blocked.

The rule applies to the tool and, in a good setup, to the target and the kind of action. A read-only request to an in-scope host can be "allow". The same tool aimed at a bulk write can be "ask". A request to a host outside the written scope is "deny".

## Which actions should need approval?

Put an action under "ask" when it has side effects that cannot be undone, costs money, touches people, or is hard to bound. Adapt the starting set below to your scope document.

| Action | Suggested rule | Reason |
|---|---|---|
| Read-only requests to in-scope hosts | Allow | Low risk; the core of the work |
| Comparison of responses between test accounts | Allow | No change to the target |
| Write or delete on test-owned records | Allow, with test-data marker | Needed for read-back proof; records belong to the tester |
| Write or delete on records the tester does not own | Deny | Could harm real data |
| File upload tests | Ask, bounded | Storage cost and malicious-file risk |
| Password guessing or login brute force | Ask, with a stated cap | Can lock accounts; cost must be stated |
| Any action that sends email or SMS | Ask | Reaches real people and costs money |
| Calls to paid third-party APIs | Ask, with a cost cap | Spend lands on your account |
| Heavy load, fuzzing at volume | Ask, with a rate cap | Can degrade the service |
| Hosts or paths outside written scope | Deny | No authorization |
| Exploit development beyond proof | Deny unless scoped | Proof of effect is the goal, not damage |
| Production access in a first run | Ask for each step, or use staging | See the [safety page](/safety/) |

Tests of uploads, password guessing, email sending and paid third-party APIs are bounded in our reports, and the report states their cost.

## Where do humans review the work?

Five review points apply.

1. Scope and authorization. Before any test, the system owner confirms the scope in writing, and Excession Labs agrees it with you.
2. Rule review. Before the run, an operator checks the allow, ask and deny rules against the scope.
3. Live approvals. During the run, a person approves or rejects each "ask" call.
4. Evidence review. Before the report, Excession Labs checks the evidence for each finding and writes the report.
5. Report review and retest. You review the report. Fixed findings can be retested; Incursion supports retesting a finding.

Point 4 controls false positives. [AI pentesting false positives](/guides/ai-pentesting-false-positives/) has the checklist.

## What makes a good approval prompt?

A good approval prompt shows the exact request and its likely effect. A person cannot judge "run upload test". They can judge this:

> **Sample approval request:** ```text
> ASK: http_request
> Target:   https://staging.harbor.example.com/api/notes/import   (in scope)
> Method:   POST, 25 requests, 1 per second
> Body:     test-owned CSV, 10 KB, marked "TEST DATA"
> Purpose:  check that import enforces the 1 MB size limit
> Side effect: creates up to 25 notes in account test-a
> Cleanup:  delete the notes after the check
> Approve / Reject / Edit limits
> ```
The prompt lets the person lower the limits. A tool that shows only "approve command?" invites people to click through.

## How do you avoid approval fatigue?

Approval fatigue happens when people see too many prompts and stop reading them. Three practices keep the ask list useful.

- Allow safe, repeated actions. Do not ask for every read.
- Group related calls into one approval with a stated cap.
- After the first run, move actions that people always approved unchanged to "allow", but only if their risk is low.

OWASP lists human-agent trust problems in its [Top 10 for Agentic Applications](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/) (ASI09 Human-Agent Trust Exploitation). That entry covers agents that people over-trust. A tired approver is the same weakness in a pentest.

## What should you ask a provider about human control?

Ask these questions of any AI pentest provider.

- Who sets the tool rules, and can I see them?
- Which actions wait for approval, and who approves?
- What stops the agent from leaving the scope?
- Who checks the evidence for each finding?
- What does the report say about actions that were refused or skipped?

[How AI pentesting works](/how-it-works/) answers these for Excession Labs. [AI versus manual pentesting](/ai-vs-manual-pentesting/) covers when a person must lead the work.

## Questions

### Does human-in-the-loop slow the test down?

Some. Approvals add waiting time at the points where a mistake would cost most. Most requests, such as reads and comparisons, run under allow rules. Good rule design keeps the ask list short, so people review the few actions that matter.

### Who should approve actions during a test?

A person who knows the scope and can say yes or no for the system owner. The agreement names that contact before testing starts. A tester who cannot reach the contact should stop the risky action and move to other work.

### What happens when the agent reaches something out of scope?

It stops that line of work. Out-of-scope hosts and actions sit under deny rules, and the finding is noted for the operator. Scope changes need a written update from the system owner.

### Is approval fatigue a risk?

Yes. If everything asks, people approve without reading. Keep ask rules for actions with real side effects, and show the exact request the agent wants to send.

## Sources

- [Excession Labs: Incursion](https://excessionlabs.ai/incursion/)
- [OWASP Top 10 for LLM Applications 2026: LLM03 Excessive Agency](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/tree/main/2026/final)
- [OWASP Top 10 for Agentic Applications: announcement (9 December 2025)](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/)