Some of my workflows shouldn’t run end to end without a person signing off at a key moment. What’s the pattern for adding a human approval step in 3B? I’m curious how the workflow pauses, how someone gives their answer, and how it picks back up based on that decision. Examples of how people set this up would be welcome.
The best pattern for human-in-the-loop approval is to split your workflow at the decision point rather than have a step sit and wait.
Everything up to the decision runs as normal, then an “ask for approval” step posts the request wherever your people already look (Slack, Teams, email, a ticket comment) with approve and deny links pointing back into the same workflow. That run then ends. The click hits a route step, which picks up from there and branches into the action or the log-and-notify path.
The mechanism is simpler than it sounds: any step can be given a route, which is just a path like /approve, and that step runs whenever someone makes a request to that URL. So an approval is two separate runs, not one paused run. Run one does the work up to the decision, posts a message wherever your people already look (Slack, Teams, email, a ticket comment) with two links, one ending in /approve and one in /deny, then finishes. Nothing is held open. Later someone clicks a link, that request lands on the matching route step, and whatever it links to downstream runs from there. That’s your resume.
Some ideas for easy places to start with 3B human-in-the-loop approval…
- Host isolation - an alert comes in, workflow gathers the context, then asks a senior analyst “isolate this laptop?” with the enrichment right there in the message. Approve fires the EDR call, deny writes a note on the ticket.
- Disabling an account - same shape, and a good one to gate because the blast radius of getting it wrong is not fun.
- Adding a domain or IP to a blocklist - this is cheap to approve, expensive to undo quietly, so a human glance is worth it.
- New hire access requests - ticket comes in, workflow works out what groups they need, manager gets the approve link before anything is provisioned.
The nice side effect is that because the resume is just an HTTP route, the approval can come from anywhere: a Slack button, a link in an email, someone’s phone browser. You’re not tied to one channel, and you get a clean record of who clicked what. 