Production Approvals: n8n Human-in-the-Loop Tool Gates

By the end of this playbook you will have:

• An n8n AI Agent whose write tools cannot fire until a human approves
• Approvals delivered on Slack (or Telegram / Teams / Gmail / n8n Chat)
• Review messages that show real tool parameters via $tool.name / $tool.parameters
• Explicit wait timeouts so paused executions do not pile up forever
• A deny path the agent handles gracefully
• A go-live checklist for production ops

This extends a working n8n instance (self-hosted or Cloud). If you do not have n8n yet, start with Self-Host n8n and Ship a Production AI Ops Agent.

Official reference: n8n docs — Human-in-the-loop for tools.

1. n8n 1.x/2.x with AI Agent node available (current stable as of Sep 2026 is in the 2.40.x line on Cloud/self-host docs — use whatever your instance runs, but confirm AI + HITL nodes exist).
2. LLM credential already working on a simple Agent workflow.
3. At least one side-effect tool to gate (HubSpot update, Gmail send, Slack post to external channel, HTTP PUT to CRM).
4. An approval channel credential: Slack recommended (DM or private #approvals).
5. A staging workflow copy — never invent HITL on the only production workflow during peak hours.

In your Agent workflow:

1. Keep search/get CRM tools connected directly to the Agent (no review) or review them too if policy demands.
2. Identify every tool that sends, updates, deletes, charges, or enrolls.
3. Those write tools will hang off a Human review step — not directly on the Agent.

Per n8n’s current UI flow:

1. Open the workflow; click the Tools connector on the AI Agent node.
2. In the Tools Panel, open the Human review section.
3. Pick the approval channel (Slack, Telegram, Teams, Gmail, WhatsApp Business Cloud, Google Chat, Outlook, or n8n Chat).
4. Configure credentials (e.g. Slack credential + destination user or channel).
5. Connect the write tools to the human review step’s tool connector (not to the Agent’s main input).

Topology mental model:

• The Agent still “sees” the write tool’s name and schema.
• The review node is a transparent intercept on the execution path.
• On approve → tool runs with the AI-supplied parameters.
• On deny → tool does not run; the Agent is told the rejection.

In the Human review node message, use n8n’s $tool helpers so reviewers see truth, not a model paraphrase:

The AI wants to use {{ $tool.name }} with:

{{ JSON.stringify($tool.parameters, null, 2) }}

Approve only if the record id and fields are correct.

$tool.name is the canvas node name. $tool.parameters includes fields filled via $fromAI().

Paused HITL executions occupy the executions queue. Set an explicit wait bound on the review step (n8n exposes wait limiting on HITL/wait-style nodes — commonly discussed as limitWaitTime in seconds; default discussion in community/skills material is on the order of ~45 minutes if left implicit).

Practical starters:

Add to the Agent system message:

• Which tools require human approval
• If denied: tell the user the action was not applied; offer a corrected proposal; never retry the same write silently in a loop
• Never claim “updated in CRM” unless the tool actually returned success after approval

Smoke test with a test record:

1. Trigger the Agent (chat or Slack) with: “Add a note to MCP TEST deal: HITL drill <date>.”
2. Confirm Slack (or your channel) receives the approval card with exact deal id + note body.
3. Click Deny once — CRM must stay unchanged; Agent acknowledges.
4. Run again; Approve — note appears; execution shows tool success.
5. Only then point the bot at a real channel.

Optional: route user chat through n8n Chat while approvals go to a manager’s Slack DM (n8n supports different channels for interaction vs review).

• [ ] Write tools only reachable through Human review
• [ ] Approval message includes $tool.parameters JSON
• [ ] Deny drill leaves CRM/email unchanged
• [ ] Approve drill mutates only the intended test record
• [ ] Wait timeout set; timeout fails closed
• [ ] System prompt covers deny behavior
• [ ] Approver channel monitored during business hours
• [ ] Executions retained for audit window
• [ ] Owner named for who may remove HITL (protected change)

• Prompt-only “please confirm” — models skip soft rules under pressure. Use HITL nodes.
• Approving paraphrases — always show parameters.
• Unlimited wait — queue clog + stale approvals on Friday afternoon messages Monday.
• Auto-approve on timeout — never for money movement or CRM ownership changes.
• Same person as requester and sole approver for high-risk actions — split duties when you can.
• HITL on reads only — misses the point; gate writes.

1. 1

   Trigger and agent tools

   Trigger: Slack mention in #revops-bot.
   AI Agent tools:

2. 2

   Approve or deny outcome

   User: “Log that Acme asked for pricing on the renewal.”
   Agent searches; finds deal id 12345.
   Review DM shows tool Create note with dealId=12345 and body text.
   Lead approves → note lands → Agent replies in thread “Logged on deal 12345.”
   If lead denies → Agent replies “Not logged — tell me the correct deal id.”

3. 3

   Clone the pattern

   Clone this pattern for Salesforce tasks, Pipedrive activities, or “send customer email” tools.

• HubSpot Search deals (direct)
• Human review (Slack DM to @revops-lead)
• child tool: HubSpot Create engagement / note

• Putting HITL only on a final Slack “summary” while the CRM write already happened upstream
• One shared #general approval channel with no owners on-call
• Re-using personal Slack tokens in production workflows
• Disabling HITL “just for today” and forgetting to turn it back on

Can I HITL the Agent’s final text instead of tools?
Yes, via chat send-and-wait patterns, but tool-level HITL is stricter for CRM/API side effects. Prefer tool gates for writes; use output review for customer-facing copy.

Does this work with subagents?
n8n documents that human review inside an agent-used-as-tool still functions — still run a deny/approve drill.

Pair chat-native brains with workflow hands: OpenClaw + n8n over MCP. Or stand up the host first: OpenClaw for Your Business.