Is withHuman actually open source?

The core is published on GitHub, but under the Elastic License 2.0, which is source available rather than an OSI approved open source licence. You can read it, run it and self-host it; you cannot offer it to others as a managed service. The Agent Approval Protocol it speaks is a separate open spec.

Do I need this if my agent already asks me before it acts?

Probably not yet. A single agent with a single approver works fine on whatever channel you already watch. The case for an approval layer starts when several agents can act, several people could approve, and you need one audit trail showing who said yes to what.

Will approval slow everything down?

Only for the calls you gate. The rules engine auto approves routine requests, so a refund under your threshold goes straight through and only the larger one waits. Gate two or three actions, not the whole tool list, or people stop reading the queue.

An approval layer for AI agents: what withHuman changes for a small team

What it does

An adapter sits in front of your agent's tool call, sends the call to withHuman, and only lets it run when a decision comes back (GitHub). Rules decide what happens next: routine calls are approved automatically, disallowed calls are denied, and consequential ones wait for the right person.

The README example is the one most owners recognise. Approve refunds up to $20 without asking, send anything larger to the payments team. Reviewers get email, Slack or Discord, and decide in the web app with the exact arguments in front of them.

Coding agents (Claude Code, Codex, OpenClaw, Pi, Hermes, DeepSeek) connect through the withhuman CLI. Your own agents use the SDKs.

The part I care about is the protocol. Agents talk over the Agent Approval Protocol, an open spec with three roles: the agent proposes a call, an adapter intercepts it and enforces the outcome, an approval provider decides. Your integration is with the spec, not with the vendor.

What it means for a small team

The fear is specific. You do not lie awake because the agent writes a dull sentence, you lie awake because it might refund the wrong customer overnight. A gate answers that in a way a longer system prompt never will.

The idea is not new. LangGraph has shipped interrupt() for a while, which pauses a graph indefinitely on its persistence layer until you resume (LangChain docs). What is new here is one queue, one audit trail and one rule set across every agent you run, instead of a pause button per framework.

Which actions to gate

Gating everything is how an approval queue gets ignored by the second week. My rule of thumb:

Action	Gate	Why
Reading a record, drafting a reply	none	Nothing leaves the building
Sending to a customer, posting publicly	human	Your name is on it
Moving money, issuing credit	human above a threshold	Cheap below it, expensive above
Writing to the CRM, merging code, deploying	human until you trust it	Reversible, but noisy to undo
Deleting records, cancelling contracts	deny outright	No agent needs this

Walk your tool list once against that table. The queue then stays small enough that people actually read it.

Trying it

Self-hosting is a single container (docker run -d -p 8080:8080 quay.io/withhuman/bundle:latest), then you read the bootstrap secret out of the container. My estimate for putting a first real agent behind it is about half a day, and most of that is the argument about which actions deserve a human, not the wiring. I have not run this myself.

Limitations

Read the licence first. Elastic License 2.0 is source available, not OSI open source, and it restricts offering the software to others as a managed service. Fine internally, a problem if you planned to resell it.

A gate is only as good as its rules. Approve everything by default and you have bought an audit trail, nothing more.

It also adds a dependency in the hot path of every gated call. My guess is that matters for a latency-sensitive agent and not at all for a refund queue, but I have not measured it.

And the project is young. I would not route a production payment flow through it in its first week.

My take

If you run one agent and you are the only approver, you do not need this yet. The inbox or chat thread you already watch is the queue. My own publishing engine works exactly that way: nothing goes out without a yes, 40+ posts a month across 14 platforms.

It earns its place when there are several agents, more than one person who could approve, and someone later asking who said yes to what. That stage arrives faster than most owners expect.

Next step: list every tool your agents can call and mark the three you would never want running unwatched. That list is the real product, whichever vendor you pick. More on agents and approvals on the blog.