Consent management for agents: the new UX pattern regulators expect

An agent that takes irreversible actions without asking is a regulatory and product disaster waiting to happen. EU AI Act, GDPR Article 22, and basic product sense all converge on: ask before you act. Here are the four consent patterns that work without grinding the user down.

Three converging pressures:

Regulation — Article 22 (GDPR) for automated decisions, Article 14 (EU AI Act) for high-risk human oversight.
Liability — irreversible agent actions become your problem if the user did not approve.
Trust — products that ask retain users; products that surprise lose them.

Implementing consent well is now a competitive feature, not just a checkbox.

The four patterns

1. Per-action confirmation

The agent proposes; user clicks confirm; only then the action runs. Standard pattern for write-tools.

Pros: explicit, auditable, conservative.
Cons: UX friction; not viable for high-frequency use.
Pick when: any irreversible side effect (send, pay, delete, post).

User pre-approves a class of actions ("the agent can read my calendar without asking"). Future actions in scope skip the prompt.

Pros: smooth UX; revocable.
Cons: users grant scopes they regret.
Pick when: read-heavy access, low-risk repeat actions.

3. Time-limited delegation

User grants permission for the next N minutes / for the current task only. Auto-revokes.

Pros: matches user mental model ("I am working with the agent now").
Cons: edge cases when tasks span sessions.
Pick when: focused work sessions where the user is engaged.

4. Threshold-based escalation

The agent acts autonomously below a threshold, asks above it. "Refund up to $50 without asking."

Pros: balances autonomy with safety.
Cons: picking the threshold is hard; thresholds drift.
Pick when: quantitative tasks (refunds, purchases, transfers).

What the prompt must show

Regulator-acceptable consent prompts have:

What the agent intends to do — plain language, not jargon.
Who is affected (the user, third parties, recipients).
Why the agent decided to do it (linked to reasoning).
Consequences if you confirm.
Clear yes / no / explain options.

Sample:

The agent wants to:
  Send an email from you to alex@example.com
  Subject: "Following up on yesterday's call"
  Body: 247 words (preview)

Why: You asked the agent to follow up after the call.
What happens if you confirm: the email sends immediately, no recall.

[ Send ]   [ Edit first ]   [ Don't send ]

Three options, not two. "Edit first" is the most-used in practice.

What does not work

One-time global consent — "the agent can do anything" is invalid under most regulations.
Pre-checked confirm boxes — invalid under GDPR.
Countdown auto-confirm — invalid; user must actively confirm.
Burying the prompt in a notification — must be in the active interface.

Implementation pattern

A working architecture:

agent decides to act
   ↓
classify: side effect? (send/pay/delete/post/etc.)
   ↓ yes                                  ↓ no
check scope-based pre-consent             execute
   ↓ valid                ↓ invalid
execute               render consent prompt
                          ↓ confirm
                       execute + audit

The classifier and the consent UI are the only new components. Wire them once, reuse across agents.

Audit hooks

Every consent decision becomes an audit event:

{
  "ts": "2026-04-25T10:14:22Z",
  "user_id": "u:alex",
  "agent": "support-bot",
  "action": "send_email",
  "args_hash": "sha256:7af2...",
  "decision": "confirmed",
  "explanation_shown": "...",
  "ui_surface": "modal"
}

Goes into the audit trail. Auditors look for: was the prompt shown, did the user confirm, can we reproduce what they saw.

Building for revocation

Two endpoints every consent system needs:

List my consents — show me what I have approved.
Revoke — pull a specific scope or all of them.

These also satisfy GDPR access and rectification rights for the consent class.

Common mistakes

No audit on the prompt itself — proves to regulators that it was shown.
Coalescing prompts — "approve these 12 actions in one click" defeats the point.
No undo for low-risk actions — confirmation is heavy; an undo window is lighter and often sufficient.
Generic prompt text — "the agent will perform an action" tells the user nothing.

Where this is heading

Two trends by 2027: standardised consent UI primitives in the Claude Agent SDK and major web frameworks, and consent-graph products that let users see what every agent across their apps can do. Build the audit hooks now and the swap gets easier.

Why consent is now mandatory