Wombat

WAF-AGN-080 – Human-in-the-Loop

Pillar: Agentic | Severity: High | Category: Identity Access | Automatable: High

Description

Human approval MUST be required for sensitive decisions. Human-in-the-loop workflows must be defined for critical actions. Approval workflows must be auditable with timestamps and approver identity. Escape hatches must exist for emergency interventions.

Rationale

Risk Description

Risk

Agents making sensitive decisions without human approval can cause irreversible damage.

Risk

Missing approval gates for high-impact actions violate accountability and compliance requirements.

Requirements

  • Human approval MUST be required for sensitive decisions.

  • Human-in-the-loop workflows must be defined for critical actions.

  • Approval workflows must be auditable with timestamps and approver identity.

  • Escape hatches must exist for emergency interventions.

Implementation Guidance

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-agn-080.tf.aws.human-in-the-loop-approved-decisions

Engine: terraform | Provider: aws | Automated: Yes

Human-in-the-loop must be configured for sensitive decisions

For high-risk agent decisions (financial transactions, legal decisions, personal data changes), human approval MUST be required. The approval workflow must capture approver identity, timestamp, and decision rationale.

Scope: resource — aws_bedrock_guardrail, aws_bedrockagent

Assertions: * human_interaction_configuration attribute exists — Human-in-the-loop must be configured for sensitive decisions.

Remediation: Configure AWS Bedrock human-in-the-loop for sensitive decision types. Define decision scopes requiring human review. Configure approval channels (email, Slack, custom UI). Store approval records in audit log.

Compliant
resource "aws_bedrock_guardrail" "sensitive_actions" {
  name = "sensitive-actions-guardrail"

  sensitive_information_policy {
    medical_information = {
      detect_masked = true
    }
    pii_entity_type = {
      detect_masked = true
    }
    financial_information = {
      detect_masked = true
    }
  }

  inappropriate_content_policy {
    hate = {
      detect_masked = true
    }
    sexual = {
      detect_masked = true
    }
    violent = {
      detect_masked = true
    }
    mix = {
      detect_masked = true
    }
  }
}

resource "aws_bedrockagent" "hitable_agent" {
  agent_name = "sensitive-agent"

  guardrail_configuration {
    guardrail_arn = aws_bedrock_guardrail.sensitive_actions.arn
    guardrail_version = "DRAFT"
  }

  human_interaction_configuration {
    human_interpretation_prompt = "Review agent decision before execution"
    human_interpretation_timeout = 7200
    human_interpretation_output_context_name = "human_approval"
  }
}
Non-Compliant
resource "aws_bedrockagent" "fully_automated" {
  agent_name = "no-human-in-loop"
  # No human-in-the-loop for sensitive actions
  # WAF-AGN-080 Violation
}

waf-agn-080.tf.aws.approval-audit-logging

Engine: terraform | Provider: aws | Automated: Yes

Human approvals must be audited with full context

All human approvals must be logged with timestamp, approver identity, decision type, input context, and approval/rejection decision. Logs must be immutable and stored separately from agent logs.

Scope: resource — aws_cloudwatch_log_group, aws_cloudwatch_log_metric_filter

Assertions: * name not empty — Approval audit logging must be configured.

Remediation: Configure CloudWatch Logs for approval events with full metadata. Use CloudTrail for API-level approval tracking. Implement log encryption and access controls for audit integrity.

Compliant
resource "aws_cloudwatch_log_group" "approval_audit" {
  name = "/aws/bedrock/approval-audit"
  kms_key_id = aws_kms_key.log_encryption.arn
  retention_in_days = 365
}

resource "aws_cloudwatch_log_metric_filter" "approvals" {
  name = "approval-metric"

  log_group_name = aws_cloudwatch_log_group.approval_audit.name

  pattern = "{ $.event_type = \"human_approval\" }"

  metric_transformations {
    metric_name      = "HumanApprovals"
    metric_namespace = "AuditMetrics"
    metric_value     = "1"
  }
}
Non-Compliant
# No approval audit logging
# WAF-AGN-080 Violation
# Human decisions not auditable

waf-agn-080.tf.aws.emergency-escape-hatch

Engine: terraform | Provider: aws | Automated: Yes

Emergency escape hatch must exist for agent intervention

An emergency escape hatch must exist for immediate human intervention. This could be a stop button, override command, or emergency shutdown mechanism accessible via console or API.

Scope: resource — aws_iam_policy, aws_sns_topic

Assertions: * name not empty — Emergency escape hatch must be configured.

Remediation: Configure an emergency stop mechanism accessible via AWS Console, CLI, or API. Define procedures for emergency intervention. Document escape hatch access and activation procedures.

Compliant
resource "aws_iam_policy" "emergency_stop" {
  name = "emergency-stop-policy"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "bedrock:StopInferenceResource",
        "lambda:StopFunction",
        "ecs:StopTask"
      ]
      Resource = [
        "arn:aws:bedrock:*:*:inference-resource/*",
        "arn:aws:lambda:*:*:function:*-emergency-stop"
      ]
    }]
  })
}

resource "aws_sns_topic" "emergency_alerts" {
  name = "emergency-agent-alerts"
}
Non-Compliant
# No emergency escape hatch
# WAF-AGN-080 Violation
# Cannot intervene in emergency

waf-agn-080.tf.azurerm.logic-app-approval

Engine: terraform | Provider: azurerm | Automated: Yes

Azure Logic Apps approval workflow must exist for sensitive agent decisions

Azure Logic Apps must implement human-in-the-loop approval workflows for sensitive agent actions, capturing approver identity and timestamp.

Scope: resource — azurerm_logic_app_workflow

Assertions: * name not empty — Logic Apps workflow must be configured for human-in-the-loop approval.

Remediation: Deploy azurerm_logic_app_workflow with HTTP trigger and Office 365 / Teams approval connector for sensitive agent decisions.

Compliant
resource "azurerm_logic_app_workflow" "agent_approval" {
  name                = "agent-approval-workflow"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
}

# Workflow definition includes Start and wait for an approval action
Non-Compliant
resource "azurerm_cognitive_deployment" "agent" {
  name = "agent-deployment"
  # No Logic Apps approval workflow configured
  # WAF-AGN-080 Violation
}

waf-agn-080.tf.google.workflows-approval

Engine: terraform | Provider: google | Automated: Yes

GCP Workflows must implement human approval step for sensitive agent decisions

GCP Workflows must include a human approval step (e.g., callback or Cloud Tasks with external approval) before executing sensitive agent actions.

Scope: resource — google_workflows_workflow

Assertions: * source_contents matches pattern (?i)approval|approved|human|review — Workflow source must include a human approval step.

Remediation: Configure google_workflows_workflow with an explicit approval step using callbacks or Cloud Tasks.

Compliant
resource "google_workflows_workflow" "agent_approval" {
  name            = "agent-approval"
  region          = "europe-west3"
  service_account = google_service_account.agent_workflows.email

  source_contents = <<EOF
main:
  params: [args]
  steps:
    - init:
        assign:
          - request_id: $${args.request_id}
    - wait_for_approval:
        call: http.get
        args:
          url: $${"https://approval.example.com/" + request_id}
        result: approval
    - execute_if_approved:
        switch:
          - condition: $${approval.body.approved == true}
            next: execute_action
          - condition: true
            next: reject_action
EOF
}
Non-Compliant
resource "google_workflows_workflow" "agent_auto" {
  name   = "agent-auto"
  region = "europe-west3"
  # No human approval step
  # WAF-AGN-080 Violation
}

waf-agn-080.tf.stackit.agentic-human-approval

Engine: terraform | Provider: stackit | Automated: Yes

Human approval for stackit

Human approval must be documented in IaC via a agentic-human-approval tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the agentic-human-approval tag/label.

Remediation: Add a agentic-human-approval tag/label to the stackit_project resource to show the stackit implementation of WAF-AGN-080 is tracked in IaC.

Compliant
resource "stackit_project" "example" {
  labels = {
    agentic-human-approval = "true"
  }
}
Non-Compliant
resource "stackit_project" "example" {
  # Missing agentic-human-approval labels
}

waf-agn-080.tf.ovh.agentic-human-approval

Engine: terraform | Provider: ovh | Automated: Yes

Human approval for ovh

Human approval must be documented in IaC via a agentic-human-approval tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the agentic-human-approval tag/label.

Remediation: Add a agentic-human-approval tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-AGN-080 is tracked in IaC.

Compliant
resource "ovh_cloud_project" "example" {
  tags = {
    agentic-human-approval = "true"
  }
}
Non-Compliant
resource "ovh_cloud_project" "example" {
  # Missing agentic-human-approval tags
}

waf-agn-080.tf.hcloud.agentic-human-approval

Engine: terraform | Provider: hcloud | Automated: Yes

Human approval for hcloud

Human approval must be documented in IaC via a agentic-human-approval tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the agentic-human-approval tag/label.

Remediation: Add a agentic-human-approval tag/label to the hcloud_server resource to show the hcloud implementation of WAF-AGN-080 is tracked in IaC.

Compliant
resource "hcloud_server" "example" {
  labels = {
    agentic-human-approval = "true"
  }
}
Non-Compliant
resource "hcloud_server" "example" {
  # Missing agentic-human-approval labels
}

Evidence

Kind Required Description

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework Controls

ISO 27001:2022

* A.8.2 – Privileged access rights * A.8.3 – Information access restriction * A.13.1.1 – Control of information in sessions

ISO 27017

* CLD.9.5 – Segregation in virtual computing environments

CIS Controls v8

* CIS 5 – Account Management * CIS 6 – Access Control Management

SOC 2 Type II

* CC4.1 – Monitoring activities * CC6.1 – Logical access security

NIST SP 800-53

* AC-2 – Account Management * AC-6 – Least Privilege * AU-2 – Event logging

NIST CSF 2.0

* PR.AA-01 – Identities and credentials are managed * DE.CM – Continuous monitoring

GDPR

* Art. 32 – Security of processing * Art. 22 – Automated individual decision-making * Art. 5(1)(f) – Integrity and confidentiality

PCI DSS v4.0

* Req 7 – Restrict access by business need to know * Req 8 – Identify and authenticate access

CSA STAR

* CCM IAM-09 – User Access Authorization * CCM Logging and Monitoring

BSI C5:2020

* IDM-01 – Identity and access management policy * OPS-01 – Operational monitoring

TISAX

* Information security – Monitoring and logging * Information security – Access rights management

ANSSI SecNumCloud

* Domain – Access management * Domain – Logging and monitoring

BIO

* BIO – Logboekhouding en monitoring * BIO – Toegangsrechten en autorisatiebeheer

ENS High

* op.acc.4 – Proceso de gestión de derechos de acceso * op.exp.6 – Gestión de cambios

UK NCSC CAF

* B2.a – Identity verification and authorisation * A4 – Policy and assurance

FedRAMP

* AC-2, AC-6, AU-2 (Moderate baseline)

CMMC 2.0

* AC.L2-3.1.1 – Limit system access to authorized users * AU.L2-3.8.1 – Flow audit logs to central log management

IT-Grundschutz

* ORP.4 – Identitäts- und Berechtigungsmanagement * ORP.1 – Organisation

IRAP

* ISM – Access control – Privileged access * ISM – Logging and monitoring

CCCS PBMM

* AC-2, AC-6 – Account and authenticator management * AU-2 – Logging and audit

MAS TRM

* Ch.6 – Access control * Ch.9 – Change management

ISMAP

* Access control and monitoring controls

FISC

* Technical measures – Access control and monitoring