WAF-AGN-080 – Human-in-the-Loop

Säule: Agentic | Schweregrad: Hoch | Kategorie: Identity Access | Automatisierbar: High

Beschreibung

Human approval MUST be required for sensitive decisions. Human-in-the-loop workflows must be defined for critical actions. Approval workflows must be auditable with timestamps and approver identity. Escape hatches must exist for emergency interventions.

Begründung

Risiko	Beschreibung
Risk	Agents making sensitive decisions without human approval can cause irreversible damage.
Risk	Missing approval gates for high-impact actions violate accountability and compliance requirements.

Risiko

Beschreibung

Risk

Agents making sensitive decisions without human approval can cause irreversible damage.

Risk

Missing approval gates for high-impact actions violate accountability and compliance requirements.

Anforderungen

Human approval MUST be required for sensitive decisions.
Human-in-the-loop workflows must be defined for critical actions.
Approval workflows must be auditable with timestamps and approver identity.
Escape hatches must exist for emergency interventions.

Implementierungsleitfaden

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level	Name	Kriterien
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Kriterien

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-agn-080.tf.aws.human-in-the-loop-approved-decisions

Engine: terraform | Provider: aws | Automated: Ja

Human-in-the-loop must be configured for sensitive decisions

For high-risk agent decisions (financial transactions, legal decisions, personal data changes), human approval MUST be required. The approval workflow must capture approver identity, timestamp, and decision rationale.

Scope: resource — aws_bedrock_guardrail, aws_bedrockagent

Assertions: * human_interaction_configuration attribute exists — Human-in-the-loop must be configured for sensitive decisions.

Remediation: Configure AWS Bedrock human-in-the-loop for sensitive decision types. Define decision scopes requiring human review. Configure approval channels (email, Slack, custom UI). Store approval records in audit log.

Compliant

resource "aws_bedrock_guardrail" "sensitive_actions" {
  name = "sensitive-actions-guardrail"

  sensitive_information_policy {
    medical_information = {
      detect_masked = true
    }
    pii_entity_type = {
      detect_masked = true
    }
    financial_information = {
      detect_masked = true
    }
  }

  inappropriate_content_policy {
    hate = {
      detect_masked = true
    }
    sexual = {
      detect_masked = true
    }
    violent = {
      detect_masked = true
    }
    mix = {
      detect_masked = true
    }
  }
}

resource "aws_bedrockagent" "hitable_agent" {
  agent_name = "sensitive-agent"

  guardrail_configuration {
    guardrail_arn = aws_bedrock_guardrail.sensitive_actions.arn
    guardrail_version = "DRAFT"
  }

  human_interaction_configuration {
    human_interpretation_prompt = "Review agent decision before execution"
    human_interpretation_timeout = 7200
    human_interpretation_output_context_name = "human_approval"
  }
}

Non-Compliant

resource "aws_bedrockagent" "fully_automated" {
  agent_name = "no-human-in-loop"
  # No human-in-the-loop for sensitive actions
  # WAF-AGN-080 Violation
}

waf-agn-080.tf.aws.approval-audit-logging

Engine: terraform | Provider: aws | Automated: Ja

Human approvals must be audited with full context

All human approvals must be logged with timestamp, approver identity, decision type, input context, and approval/rejection decision. Logs must be immutable and stored separately from agent logs.

Scope: resource — aws_cloudwatch_log_group, aws_cloudwatch_log_metric_filter

Assertions: * name not empty — Approval audit logging must be configured.

Remediation: Configure CloudWatch Logs for approval events with full metadata. Use CloudTrail for API-level approval tracking. Implement log encryption and access controls for audit integrity.

Compliant

resource "aws_cloudwatch_log_group" "approval_audit" {
  name = "/aws/bedrock/approval-audit"
  kms_key_id = aws_kms_key.log_encryption.arn
  retention_in_days = 365
}

resource "aws_cloudwatch_log_metric_filter" "approvals" {
  name = "approval-metric"

  log_group_name = aws_cloudwatch_log_group.approval_audit.name

  pattern = "{ $.event_type = \"human_approval\" }"

  metric_transformations {
    metric_name      = "HumanApprovals"
    metric_namespace = "AuditMetrics"
    metric_value     = "1"
  }
}

Non-Compliant

# No approval audit logging
# WAF-AGN-080 Violation
# Human decisions not auditable

waf-agn-080.tf.aws.emergency-escape-hatch

Engine: terraform | Provider: aws | Automated: Ja

Emergency escape hatch must exist for agent intervention

An emergency escape hatch must exist for immediate human intervention. This could be a stop button, override command, or emergency shutdown mechanism accessible via console or API.

Scope: resource — aws_iam_policy, aws_sns_topic

Assertions: * name not empty — Emergency escape hatch must be configured.

Remediation: Configure an emergency stop mechanism accessible via AWS Console, CLI, or API. Define procedures for emergency intervention. Document escape hatch access and activation procedures.

Compliant

resource "aws_iam_policy" "emergency_stop" {
  name = "emergency-stop-policy"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "bedrock:StopInferenceResource",
        "lambda:StopFunction",
        "ecs:StopTask"
      ]
      Resource = [
        "arn:aws:bedrock:*:*:inference-resource/*",
        "arn:aws:lambda:*:*:function:*-emergency-stop"
      ]
    }]
  })
}

resource "aws_sns_topic" "emergency_alerts" {
  name = "emergency-agent-alerts"
}

Non-Compliant

# No emergency escape hatch
# WAF-AGN-080 Violation
# Cannot intervene in emergency

waf-agn-080.tf.azurerm.logic-app-approval

Engine: terraform | Provider: azurerm | Automated: Ja

Azure Logic Apps approval workflow must exist for sensitive agent decisions

Azure Logic Apps must implement human-in-the-loop approval workflows for sensitive agent actions, capturing approver identity and timestamp.

Scope: resource — azurerm_logic_app_workflow

Assertions: * name not empty — Logic Apps workflow must be configured for human-in-the-loop approval.

Remediation: Deploy azurerm_logic_app_workflow with HTTP trigger and Office 365 / Teams approval connector for sensitive agent decisions.

Compliant

resource "azurerm_logic_app_workflow" "agent_approval" {
  name                = "agent-approval-workflow"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
}

# Workflow definition includes Start and wait for an approval action

Non-Compliant

resource "azurerm_cognitive_deployment" "agent" {
  name = "agent-deployment"
  # No Logic Apps approval workflow configured
  # WAF-AGN-080 Violation
}

waf-agn-080.tf.google.workflows-approval

Engine: terraform | Provider: google | Automated: Ja

GCP Workflows must implement human approval step for sensitive agent decisions

GCP Workflows must include a human approval step (e.g., callback or Cloud Tasks with external approval) before executing sensitive agent actions.

Scope: resource — google_workflows_workflow

Assertions: * source_contents matches pattern (?i)approval|approved|human|review — Workflow source must include a human approval step.

Remediation: Configure google_workflows_workflow with an explicit approval step using callbacks or Cloud Tasks.

Compliant

resource "google_workflows_workflow" "agent_approval" {
  name            = "agent-approval"
  region          = "europe-west3"
  service_account = google_service_account.agent_workflows.email

  source_contents = <<EOF
main:
  params: [args]
  steps:
    - init:
        assign:
          - request_id: $${args.request_id}
    - wait_for_approval:
        call: http.get
        args:
          url: $${"https://approval.example.com/" + request_id}
        result: approval
    - execute_if_approved:
        switch:
          - condition: $${approval.body.approved == true}
            next: execute_action
          - condition: true
            next: reject_action
EOF
}

Non-Compliant

resource "google_workflows_workflow" "agent_auto" {
  name   = "agent-auto"
  region = "europe-west3"
  # No human approval step
  # WAF-AGN-080 Violation
}

waf-agn-080.tf.stackit.agentic-human-approval

Engine: terraform | Provider: stackit | Automated: Ja

Human approval for stackit

Human approval must be documented in IaC via a agentic-human-approval tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the agentic-human-approval tag/label.

Remediation: Add a agentic-human-approval tag/label to the stackit_project resource to show the stackit implementation of WAF-AGN-080 is tracked in IaC.

Compliant

resource "stackit_project" "example" {
  labels = {
    agentic-human-approval = "true"
  }
}

Non-Compliant

resource "stackit_project" "example" {
  # Missing agentic-human-approval labels
}

waf-agn-080.tf.ovh.agentic-human-approval

Engine: terraform | Provider: ovh | Automated: Ja

Human approval for ovh

Human approval must be documented in IaC via a agentic-human-approval tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the agentic-human-approval tag/label.

Remediation: Add a agentic-human-approval tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-AGN-080 is tracked in IaC.

Compliant

resource "ovh_cloud_project" "example" {
  tags = {
    agentic-human-approval = "true"
  }
}

Non-Compliant

resource "ovh_cloud_project" "example" {
  # Missing agentic-human-approval tags
}

waf-agn-080.tf.hcloud.agentic-human-approval

Engine: terraform | Provider: hcloud | Automated: Ja

Human approval for hcloud

Human approval must be documented in IaC via a agentic-human-approval tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the agentic-human-approval tag/label.

Remediation: Add a agentic-human-approval tag/label to the hcloud_server resource to show the hcloud implementation of WAF-AGN-080 is tracked in IaC.

Compliant

resource "hcloud_server" "example" {
  labels = {
    agentic-human-approval = "true"
  }
}

Non-Compliant

resource "hcloud_server" "example" {
  # Missing agentic-human-approval labels
}

Evidenz

Art Erforderlich Beschreibung

Art	Erforderlich	Beschreibung
`iac`	Erforderlich	Terraform configuration implementing the control.
`governance`	Erforderlich	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

WAF-AGN-080 – Human-in-the-Loop

Beschreibung

Begründung

Anforderungen

Implementierungsleitfaden

Reifegrade

Checks

waf-agn-080.tf.aws.human-in-the-loop-approved-decisions

waf-agn-080.tf.aws.approval-audit-logging

waf-agn-080.tf.aws.emergency-escape-hatch

waf-agn-080.tf.azurerm.logic-app-approval

waf-agn-080.tf.google.workflows-approval

waf-agn-080.tf.stackit.agentic-human-approval

waf-agn-080.tf.ovh.agentic-human-approval

waf-agn-080.tf.hcloud.agentic-human-approval

Evidenz

Verwandte Controls