Document preventing AI agents from responding to manual interventions

src/pages/docs/projects/built-in-step-templates/manual-intervention-and-approvals.md

@@ -1,7 +1,7 @@
 ---
 layout: src/layouts/Default.astro
 pubDate: 2023-01-01
-modDate: 2026-10-13
+modDate: 2026-10-21
 title: Manual intervention and approval step
 icon: fa-solid fa-check
 description: Manual intervention and approvals allow a human to review, approve, or sign off on deployments.
@@ -91,6 +91,33 @@ When aborting a deployment, it's a good idea to write a reason into the **Notes*
 
 The tasks page, under the "Needs Approval" tab, contains a list of deployments pending manual intervention. In addition to the deployment page, you can **Assign**, **Proceed**, and **Abort** deployments from this list.
 
+## Prevent AI agents from responding
+
+By default, AI agents can assign and submit manual interventions, the same as the person they act for. To make sure a person responds, set **Agent Responses** to **Prevent AI agents from responding** on the manual intervention step.
+
+When AI agents are prevented from responding:
+
+- AI agents can't assign or submit the manual intervention. They're told a person needs to respond, with a link to the task.
+- The task page shows that AI agents can't respond to the manual intervention.
+- People can always respond.
+- Only callers that sign in as an AI agent are blocked, such as with an AI agent API key or through the Octopus MCP server. An agent using a person's API key counts as a person.
+- If a **Deploy a release** step runs a deployment that's waiting on this manual intervention, AI agents can't respond to it from the parent either.
+- AI agents can still cancel the task if they have permission to.
+
+You can bind **Agent Responses** to a variable. If the value isn't `True` or `False`, AI agents are prevented from responding and the task log shows a warning.
+
+To pause only deployments or runbook runs started by an AI agent, set the step's **Run Condition** to **Variable** with this expression:
+
+```text
+#{if Octopus.Deployment.CreatedBy.ActorType == "Agent"}true#{/if}
+```
+
+:::div{.warning}
+**This setting is advisory, not a security boundary.** Anyone who can edit the deployment process or runbook can turn this setting off or remove the step. This includes an AI agent with that permission.
+
+A project variable named `Octopus.Action.Manual.PreventAgentResponses` overrides this setting. Anyone who can edit project variables can use it to let AI agents respond.
+:::
+
 ## Output variables
 
 When a manual step is completed, details of the interruption are saved as variables that can be used in other steps including [email](/docs/projects/built-in-step-templates/email-notifications) templates.