Integrations
LangGraph human approval: from pausing the graph to an accountable signature
For teams running LangGraph agents that already pause for a human, and who now need the pause to carry authority: a named approver, a limit, a signature and a record an auditor can replay.
GembaOS is a zero-trust governance runtime for enterprise AI agents: policy-decided access, single-use clearance tokens bound to exact parameters, and accountable human approvals, running on-premises or in a private VPC. This page is for a LangGraph agent that already stops and asks a person, and now has to prove that the person was allowed to say yes.
What does an interrupt give you, and what does it leave to you?
Pausing a graph is a solved problem. LangGraph’s interrupt and its checkpointer stop execution at a node, persist the state, and resume with whatever value the application hands back. That is control flow, and it is the right half to have solved. The other half is authority, and the framework deliberately leaves it to the application.
| Question | The graph answers it | Left to the application |
|---|---|---|
| Can we stop here and wait? | Yes | — |
| Can we resume later, or after a restart? | Yes | — |
| Who is entitled to answer this? | No | The route, from the Delegation of Authority |
| Was it really that person? | No | An identity-bound signature |
| Is the amount inside their limit? | No | The policy, and the target system’s own limits |
| What if the approver is away? | No | Stand-in rules, consult, transfer, escalate |
| Can the resumed action run twice? | No | Single-use authorization and an idempotency key |
A pause that anyone can answer is not an approval. It is a pause.
What does GembaOS add?
The sensitive tool call points at the GembaOS capability gateway. From there, the Delegation of Authority decides the route; where the route reserves a step for a person, the call becomes an approval request that a named approver signs with a passkey. The clearance is issued from the arguments that person saw, and the host — not the model — makes the call.
The approver is not reading a JSON payload. The request states the effect and whether it can be undone, the target, the amount and the limit it was checked against, how long the clearance lasts, how many times it may be used, and what will be re-checked just before the write.
What changes in your stack?
| Layer | Before | After |
|---|---|---|
| Planning and state | LangGraph | Unchanged |
| Checkpointer | Yours | Unchanged |
| Sensitive tool call | Straight to the business system, with a credential in reach | To the capability gateway; the credential stays there |
| The human step | An interrupt the application resolves | A routed approval request signed with a passkey, with a reason on every step |
| Absence and escalation | Application logic | Consult, transfer, escalate and take over over an org chart imported from your directory (human routes) |
| What is left afterwards | Application logs | A hash-chained work item an audit replay can re-run |
Summary
LangGraph decides how the agent thinks and when it stops. It does not claim to decide who in your organization may authorize what, and building that inside a graph means rebuilding a Delegation of Authority in application code. Keep the graph, move the sensitive call one hop, and let the approval carry a name, a limit, a signature and an execution that happens once.
Questions this note answers
Do we have to rewrite our LangGraph agent?
No. The orchestration, the state and the checkpointer stay as they are. A sensitive tool call points at the GembaOS capability gateway rather than at the business system, so what changes is the endpoint and what happens behind it, not how the agent reasons or plans.
Can this run on-premises?
Yes. GembaOS is a single Linux binary with its own data directory, running on-premises or in a private VPC, with self-hosted or cloud models. No external service is required to operate it, so the approval path and the audit record stay inside your network.
Who decides that a step needs a human at all?
The policy does, not the agent and not the graph. The route comes from your Delegation of Authority: a refund inside the delegated limit can pass on the agent stamps, and the same refund above the limit becomes an approval request for the finance owner. Both routes are recorded the same way.
What happens if the graph resumes with a stale decision?
The write does not go through on the strength of the resume. Before the business system is called, the host re-reads the real state and compares it with the facts the approver signed, the clearance is time-limited and single-use, and the idempotency key is filled by the host rather than by the agent.
Sources
As of September 2026 GembaOS holds no certification; the control mappings on this site are self-assessed, not audited. GembaOS is in its design partner stage. Read about the design partner program.
Last updated: · GembaOS v0.2