Human in the loop

The agent pauses and asks a person to approve before doing anything real: sending, spending, deleting, deploying.

ask me before it does anythingapproval stepHITLconfirm before it actsmanual approval gatedo not let it send the email without mehuman review checkpoint

See it

Live demo coming soon

What it is

Human in the loop is the pattern where an agent stops short of acting, shows a person what it intends to do, and waits. The agent proposes, the human disposes. Technically it means pausing the agent loop at a tool call, persisting the pending action, and resuming only on approval, which is why it forces your agent to be resumable rather than a single long-running function.

Put the gate where mistakes are expensive or public: sending email, spending money, deleting rows, merging code, messaging customers, anything with a legal footprint. Let genuinely reversible work run unattended. Two design details do most of the work: show the exact payload as a diff or preview rather than a summary of it, and let the human edit the proposed action, not just pick yes or no.

Gotcha: approval fatigue turns the gate into theatre. Ask about everything and people learn to click approve without reading, which is worse than no gate because now there is a signature on it. Tier your actions, allowlist the boring ones, and keep the interruptions rare enough that each one still gets read. Also decide what a timeout means up front: silence should expire the action, never auto-approve it.

Ask AI for it

Add a human approval gate to this agent. Classify every tool call as auto (read-only or trivially reversible) or gated (sends, payments, deletes, writes to external systems). For gated calls, do not execute: persist the pending action with its full arguments, emit an approval request showing the exact payload as a readable diff, and suspend the run. On approval resume from that step with the possibly edited arguments; on rejection feed the reason back to the agent as an observation so it can replan; on a 24 hour timeout expire the action rather than approving it. Record who approved what and when in an audit log.

You might have meant

agentguardrailstool calling function callingprompt injectionevals