n8n 2.35: Native Audit Trail and Human-in-the-Loop for AI Agents (HITL)

An AI agent that writes to a production database on its own, sends an email to a customer, or deletes a record is worrying for good reason: nobody wants to find out about it after the fact, buried in logs. Until now, proving that a human had actually approved a sensitive step in an n8n workflow meant building it yourself — a Wait node, a resume webhook, a Supabase table to timestamp the decision, as covered in our guide on human approval with the Wait node and Slack. n8n 2.35, released on August 18, 2026, adds two native mechanisms that change this: an automatic audit timestamp on Send and Wait nodes, and mandatory human approval built directly into AI Agent tools. Here's what actually changes, and where it doesn't replace what you may have already built.

respondedAt: a native audit timestamp, no configuration needed

As of 2.35, every Send and Wait node — Slack, Telegram, Discord, WhatsApp, Google Chat, Gmail, Outlook, Email/SMTP, Microsoft Teams, and the Chat Trigger node — now includes a respondedAt field in ISO-8601 format in its output, the moment n8n receives a response. No configuration is required: the field appears automatically alongside the existing fields (approved, text, or form, depending on the response type), and it doesn't change the output shape of workflows already in production.

In practice, that means a simple Slack approval button now natively carries proof of the exact moment someone clicked — without you having to build the timestamping mechanism yourself. To turn that into a genuine, persistent audit trail rather than ephemeral execution data, just wire that field into a logging table, exactly as our guide on the GDPR audit trail with Supabase already does — except the timestamp itself no longer needs to be hand-coded.

HITL for AI Agent tool calls: gating the action, not the whole workflow

The second addition targets a different problem specific to AI agents: an AI Agent decides on its own, mid-reasoning, which tool to call and when. You can't place a Wait node "before" an action you don't know in advance the agent will even trigger. n8n 2.35 introduces approval at the tool level itself: a tool flagged as sensitive ("gated") won't execute until a human has explicitly approved the action the agent is requesting — deleting a record, writing to a production system, sending a high-impact email.

The key point: review relies on n8n's standard integrations (Slack, Teams, email…), so approval isn't locked into a single interface. The decision can be routed to the right person, on the channel they already use day to day — which brings this mechanism close to the custom tools you can already build for an AI Agent in n8n, but without having to reimplement the pause logic for every new sensitive tool. It's also one more safeguard against prompt injection attacks targeting an AI agent: even if malicious content pushes the agent to attempt a destructive action, the gated tool stands between the request and the actual execution.

Subject and actor: who asked, who approved

Another detail that matters for a genuine audit trail: the record keeps both the subject (who, or which process, requested the action — often the AI agent itself, triggered by a user) and the actor (the human who actually approved it). This distinction avoids the classic ambiguity of a log that only says "action executed" without specifying whether the AI or a human ultimately bears responsibility for it — a nuance that becomes central the moment an auditor or regulator asks the question.

An audit trail is not proof of human vigilance

A reliable timestamp proves a human clicked at a given moment — it doesn't prove they actually read and evaluated what they were approving. This is a long-documented finding in research on automated systems: a review study by Parasuraman and Manzey, published in 2010 in Human Factors, shows that "automation complacency" and automation bias affect novices and experts alike, and don't disappear with training — an operator used to approving mostly legitimate requests eventually clicks "approve" without really checking (Parasuraman & Manzey, 2010, Human Factors). In practice, for an n8n HITL circuit: a gated tool that sends dozens of approval requests a day to the same person quickly loses its value once approving becomes a reflex rather than a real decision. Reserve gating for genuinely risky actions, not everything an agent could possibly do.

Where this fits into a compliance approach

The principle behind both additions — keeping an identifiable human in the final decision seat over a high-stakes automated action — connects directly to the notion of meaningful human control developed by Santoni de Sio and van den Hoven in a landmark 2018 paper in Frontiers in Robotics and AI: an automated system stays under acceptable human control only if the humans involved genuinely understand what they're approving and remain accountable for it (Santoni de Sio & van den Hoven, 2018). That's essentially the "human oversight" requirement the EU AI Act imposes on high-risk systems — see our guide on automating AI Act compliance with n8n — and a useful building block for documenting ISO 27001 or SOC 2 compliance evidence: a native, reliable timestamp with distinct subject and actor fields is evidence an auditor recognizes immediately, provided it complements a real review process rather than simulating one.

Updating your instance

On n8n Cloud, the update is automatic: these features land without any action on your part once they reach general availability. On a self-hosted instance, you need to be running 2.35 or later — follow our guide on updating n8n on Docker without breaking anything, and if your instance is several versions behind, our migration report before the 2.0 update helps spot breaking changes to handle before jumping straight to 2.35.

Wrapping up

n8n 2.35 moves part of what you used to have to build yourself — timestamping an approval, gating a sensitive agent action — directly into the product, with zero configuration for the first and fine-grained control for the second. It doesn't remove the need to think through who's allowed to approve what, or to build the persistent logging and reporting layer that turns a respondedAt field into a real, audit-ready trail. That's exactly what our Compliance & Audit Pack (149 €) already packages: a conversational questionnaire, timestamped Supabase logging, automatic follow-ups, and an AI-generated summary report — a base ready to plug into these new native mechanisms instead of reinventing them from scratch.