Human-in-the-loop stable

What it is

An agent that asks permission for everything is a chatbot with extra steps. One that asks for nothing will eventually delete something. Human-in-the-loop is the discipline of deciding which actions pause for a person, and building the pause so it survives a restart.

How it works

The production pattern is asynchronous and durable:

1. The agent reaches an action that needs approval.
2. It serializes its state to a checkpoint.
3. The request goes to a queue with a time-to-live, and a person is notified.
4. On approval, execution resumes from the checkpoint. On timeout or rejection, it does not.

Frameworks expose this directly: LangGraph interrupts, the OpenAI Agents SDK, Microsoft’s Agent Framework. Protocols carry it too: ACP has permission requests, AG-UI streams state the user can edit mid-run, MCP has elicitation, and Managed Agents has a permissions layer.

Deciding what needs approval

Score the action on four dimensions:

• Irreversibility: can it be undone?
• Blast radius: how many people or records does it touch?
• Compliance exposure: does it move money, PII or production config?
• Confidence: how sure is the agent that this is right?

High on any of them means pause. Everything else runs.

Watch out for

• Approval fatigue. If people approve without reading, you have no control, just latency.
• The trend is toward policy-driven delegation: pre-approve classes of action rather than prompting each time.