Why Prompt-Based AI Approval Gates Can Be Bypassed and What to Use Instead

AI agents that rely on prompt instructions to enforce user approval before sensitive actions like money transfers can be manipulated by users or prompt injections into skipping those checks. Developer guidance from Genkit highlights two distinct human-in-the-loop patterns: interrupt-as-a-tool, where the LLM decides whether to request approval, and restartable tools, where a hard-coded logic gate in the application code enforces the check. Because the interrupt-as-a-tool pattern depends on a system prompt instruction, a persuasive input can convince the model to bypass the confirmation step entirely. Restartable tools, by contrast, run a deterministic code-level check that the LLM cannot override or forge, making them suitable for security- and money-critical operations. Developers are advised to use prompt-based interrupts only for low-stakes clarifications and to rely on restartable tools whenever financial or security controls must be strictly enforced.