No single person, or agent, can both request and approve a sensitive action.
You have done this if
The agent drafts the refund, a human approves it, and a different system executes it.
Say it in a review
The agent proposes, a person approves, and the system of record executes; no one step can do all three.
On the AI Application map Human review, Agent