Human in the loop for AI agents: where to put approvals
Human in the loop means designing specific points where a person approves, corrects or takes over from an agent. Put approvals before actions that are irreversible, expensive, sensitive or visible to customers, add handoffs when the agent is unsure or the user is upset, and review samples of what the agent does on its own. Make each approval quick and informed, by showing the person exactly what will happen and why, or approvals turn into clicking "yes" without reading.
Why agents need people in the loop
Agents make mistakes: they misread a request, choose the wrong tool, act on a wrong value, or get manipulated by text in a document. For an answer in a chat, a mistake is an inconvenience. For an action, like a refund, an email to a customer, a deleted record, a deployed change or a payment, a mistake has real consequences.
A person in the loop is how you get the speed of automation on routine work while keeping judgement and accountability for the decisions that matter. It is not a sign that the agent failed. It is part of a good architecture.
Where to put approvals
Decide by risk, not by habit.
| Action | Approval |
|---|---|
| Reading data, searching, drafting | None, but log it |
| Actions on the user's own request that are easy to undo | Usually none, or user confirmation |
| Sending messages to customers or external people | Approval, at least at first |
| Money: refunds, payments, discounts above a limit | Approval above a threshold |
| Deleting or overwriting data | Approval |
| Changes to production systems or code | Review before merge or deploy |
| Legal, medical or financial decisions | A qualified person decides, the agent assists |
You can relax approvals over time for actions where the agent has a long, measured record of being right, and tighten them again if quality drops.
Patterns
Approve before acting
The agent prepares the action, a drafted email, a proposed refund, a code change, and pauses until a person approves, edits or rejects it. This is the most common pattern for write actions.
Confirm with the user
For actions on the user's own behalf, the agent asks the user to confirm: "I'll cancel order ORD-123456 and refund ₹4,999 to your card. Confirm?"
Escalate and hand off
When the agent is unsure, can't solve the problem, detects a sensitive situation (a complaint, a safety issue, a legal threat), or the user asks for a person, it hands off to a human with a summary of the conversation, so the person doesn't have to start over.
Review after the fact
For low-risk, high-volume actions, a person reviews a sample of what the agent did, and the results feed back into improving prompts, tools and tests.
Edit and continue
The person corrects the agent's plan or output, and the agent continues from the corrected version.
Designing good approval steps
An approval is only as good as the information the person sees.
- Show the exact action: the recipient, the amount, the text, the change.
- Show why: the agent's reasoning and the sources or data it used.
- Show the risk: what changes if this is approved, and whether it can be undone.
- Make it fast: approve, edit or reject in one place.
- Record the decision and who made it.
If people approve hundreds of actions a day without enough information, they stop reading, and the approval becomes a rubber stamp. Use approvals for decisions that need a person, and automate the rest with code checks.
Technical implementation
An agent waiting for approval has to pause, sometimes for hours. That means saving its state, the task, the history and the pending action, to durable storage, and resuming when the decision comes in. Frameworks like LangGraph support pausing at a step and resuming with the person's input, built on checkpoints. See agent state and recovery.
Enforce approvals in the tool, not only in the prompt. A refund tool should refuse to execute without an approval record, whatever the model says.
From the floor
When we built the customer support agent in the bootcamp, I called human in the loop the most important part of the architecture. If I created an AI to teach you in these sessions and I wasn't in the loop, I wouldn't know what it was doing, and it could make mistakes nobody catches, so I need to keep an eye on it. The agent's flow had routing, retrieval from company data, response generation and handoffs to a person when needed.