Human-in-the-Loop

Human-in-the-loop is the control architecture that makes agency accountable — approval gates (the agent proposes, the human approves, for consequential actions, L212), interrupts (the human stops or redirects the loop, L205), and takeover (the human continues the task, L207) — designed control points where the loop's riskiest transitions wait for a human decision, recorded for the audit trail (L322).

The one-sentence interview answer: "HITL is the accountability architecture (L208). Three patterns. Approval gates — the agent proposes a consequential action — a refund, a transfer, a publish — and the system waits for a human's approval before executing (L212). The gate sits at the risk threshold: read actions run, write actions wait (L315). Interrupts — the human can stop or redirect the loop mid-run, from the trace (L213): 'that's the wrong direction, go back to step 12' (L207). Takeover — the human continues the task themselves from the checkpoint (L207). The design: the state is checkpointed before the gate (L207), the human's decision is recorded (L322), and the loop is accountable because the human can always say no (L324)."

Think of HITL as a pilot and a control tower. The pilot (the agent) flies the loop — the routine actions are the pilot's (read, search, draft, L201). The control tower (the human) holds the approvals for the consequential ones — a course change, a landing, an emergency action — the pilot requests, the tower approves or denies (L208). The tower can also interrupt: "go around, try the other runway" (L205) — and if needed, the tower takes over the controls entirely (L207). Every decision is logged in the tower's logbook (L322): the pilot is accountable because the tower was in the loop at the critical moments (L324).

   the pilot (agent)                    the tower (human)
   ┌─────────────────────────┐          ┌──────────────────────────────┐
   │ routine: read, search,  │          │ approve: refund, transfer,   │
   │   draft — no gate (L201)│  ─────►  │   publish — the risk gate    │
   │ risky: refund, publish  │          │   (L212, L315)               │
   │   → REQUEST approval    │          │ interrupt: redirect mid-run  │
   └─────────────────────────┘          │   (L205) · takeover (L207)   │
                                         │ every decision logged (L322) │
                                         └──────────────────────────────┘

The mental model is pilot + tower: routine actions fly free, consequential ones wait for approval, and the tower can interrupt or take over — with the logbook as the record (L322).

   the agent proposes an action (L201)
        │
        ▼
   ┌──────────────────────────────────────────────────────────┐
   │ 1 · CLASSIFY THE RISK (L212, L315)                       │
   │     read-only? → executes, no gate (L201)                │
   │     consequential? → the gate (L208)                     │
   └──────────────────┬───────────────────────────────────────┘
                      ▼ consequential
   ┌──────────────────────────────────────────────────────────┐
   │ 2 · CHECKPOINT + REQUEST (L207, L213)                    │
   │     the state is saved (so approval resumes exactly)     │
   │     the human sees: the action + its context (L322)      │
   └──────────────────┬───────────────────────────────────────┘
                      ▼
   ┌──────────────────────────────────────────────────────────┐
   │ 3 · THE HUMAN DECIDES (L208)                             │
   │     approve → execute (L212)                             │
   │     deny → the agent re-plans (L202)                     │
   │     edit → the human adjusts the parameters              │
   └──────────────────┬───────────────────────────────────────┘
                      ▼
   the decision is recorded (L322) → the loop continues (L200)

The flow is the gate: classify risk → checkpoint + request → the human decides → record — the consequential transition waits for a human (L208).

• Approval gates (L208). The agent proposes a consequential action; the system waits for a human's approval (L212). The threshold is the design: read actions run (L201), write actions with consequence wait (L315) — refunds, transfers, publishes, deletes (L212). The gate's context matters: the human sees the action and why the agent proposed it (the reasoning, L203, and the trace, L213).
• Interrupts (L205). The human can stop or redirect the loop mid-run — from the trace (L213): the loop pauses, the human redirects (a new instruction, L202), and the loop resumes from the checkpoint (L207). The interrupt is the human's course-correction (L208).
• Takeover (L207). The human continues the task themselves — from the checkpoint (L207): the state is handed over, the human completes the remaining steps, and the record shows the handoff (L322).
• The record (L322). Every human decision is logged — the action, the context, the decision, the timestamp (L322). The record is the accountability: the loop's consequential actions are human-authorized, auditable (L324).

• Finance agents. Transfers are approval-gated (L208); balance reads run free (L201). The gate shows the amount and the reason (L203).
• Support agents. Refunds and account changes wait for approval (L315); drafts run free. The human edits the refund amount before approving (L208).
• Publishing agents. Posts and emails are gated (L208); drafting runs free (L201). The human approves the copy (L324).
• Automation workflows (L217). The approval gates are the workflow's control points (L230) — the L228 pattern (L208).
• Anything consequential (L212). The gate is the accountability architecture (L324) — the control point that makes agency usable (L208).

The through-line: HITL is where the agent's power becomes accountable — the gates, interrupts, and takeover put a human at the consequential moments (L208, L324).

Say it in four moves:

1. The three patterns. "Approval gates for consequential actions (L208), interrupts for course-correction (L205), takeover for handoff (L207)."
2. The threshold. "Read actions run (L201); write actions with consequence wait (L315) — the threshold is the risk design (L212)."
3. The mechanics. "The state is checkpointed before the gate (L207), so approval resumes the exact action — and the human sees the action with its reasoning (L203, L213)."
4. The record. "Every decision is logged (L322) — the agent is accountable because the human can say no (L324)."

• The threshold is the design (L212, L315). The senior answer names which actions are gated and why — consequence, irreversibility (L212) — not "everything is gated" (friction, L151) or "nothing is" (liability, L211).
• The gate's context is its quality (L203, L213). A human approves better when they see the action and the agent's reasoning (L203) — the trace (L213) is the gate's input (L208).
• The checkpoint brackets the gate (L207). Approval resumes the exact action — the state is saved before the request (L207), so approve, deny, and edit all resume cleanly (L208).
• The record is the accountability (L322, L324). The audit trail (L322) of human decisions is what makes the agent's consequential actions defensible (L324) — the governance story (L373).
• HITL composes with the failure modes (L211). The gate is the answer to the excessive-agency failure (L212) — and the interrupt (L205) is the answer to drift (L211): the human's eyes are the last guardrail (L209).

• No gates (L212). Every action executes — the excessive-agency failure (L212); the agent is a liability (L211).
• Everything gated (L151). Every read waits for approval — friction (L151) and the human becomes the bottleneck (L150); the threshold is the design (L315).
• Gates without context (L203). The human approves blind — no reasoning, no trace (L213); the gate's quality is its context (L208).
• No checkpoint before the gate (L207). The approval resumes a different state — approve, deny, and edit break (L207).
• Decisions unrecorded (L322). The approvals leave no trail — the accountability (L324) is gone (L322).
• Interrupts impossible (L205). The human can't stop the loop — drift (L211) runs to the budget (L205).

• Set the risk threshold (L212, L315) — read free, consequential gated (L208).
• Show the action with its reasoning (L203, L213) — the gate's context is its quality (L208).
• Checkpoint before the gate (L207) — approval resumes the exact action (L255).
• Record every decision (L322) — the audit trail is the accountability (L324).
• Design the interrupts (L205) — the human can stop, redirect, or take over (L207).
• Test the gate (L341) — the golden set covers the approve/deny/edit paths (L343).

Q: How do you keep an agent safe?

A: Human-in-the-loop (L208). Three patterns: approval gates — the agent proposes a consequential action and the system waits for a human (L212); interrupts — the human stops or redirects the loop mid-run (L205); takeover — the human continues the task from the checkpoint (L207). The threshold is the design: read actions run (L201), write actions with consequence wait (L315). Every decision is recorded (L322).

Q: Which actions are approval-gated?

A: The consequential ones (L212): refunds, transfers, publishes, deletes — write actions with irreversible effects (L315). Read actions — search, read, draft — run free (L201). The threshold is a design decision: too wide, the human is the bottleneck (L151); too narrow, the agent is a liability (L211). Consequence and irreversibility set the line (L212).

Q: What does the human see at the gate?

A: The action and its reasoning (L208). The agent's proposal — the tool, the parameters (L201) — plus why it proposed it: the reasoning (L203) and the trace context (L213). A human approves better with the "why" in view (L324). The gate's context is its quality — a blind approval is a rubber stamp (L322).

Q: How does the loop resume after the human decides?

A: The checkpoint brackets the gate (L207). The state is saved before the request (L207), so approve executes the exact action, deny re-plans (L202), and edit adjusts the parameters — all resuming cleanly (L255). And the decision is recorded (L322): the loop is accountable because the human's approvals are auditable (L324).

• How do you set the risk threshold (L212)?
• What context should the gate show (L203)?
• How does the interrupt work (L205)?
• How do you record the decisions (L322)?
• How does HITL compose with automation workflows (L228)?

The senior read: the right column is the accountability architecture — the human at the consequential moments, with the record to prove it (L208).

// Human-in-the-loop: the risk threshold, the gate, the record (L208, L322).
const RISK = {                                           // the threshold (L212, L315)
  read_only: ['get_balance', 'search_kb'],
  gated: ['refund', 'transfer', 'publish'],
};

async function runStep(proposal, ctx) {
  // CLASSIFY — read actions run free (L201, L315).
  if (RISK.read_only.includes(proposal.tool)) {
    return execute(proposal, ctx);                       // no gate (L208)
  }
  if (!RISK.gated.includes(proposal.tool)) return deny(proposal, 'tool not classified');

  // THE GATE — checkpoint, request, decide, record (L207, L208, L322).
  await checkpoint(ctx.state, 'before-gate');            // resume the exact action (L207)
  const request = {
    action: proposal,                                    // what (L201)
    reasoning: ctx.scratchpad.reasoning.at(-1),          // why (L203)
    context: summarizeTrace(ctx.trace),                  // the record (L213)
  };
  const decision = await humanApprove(request);          // the tower (L208)
  await logDecision(request, decision);                  // the logbook (L322)

  switch (decision.kind) {
    case 'approve': return execute(proposal, ctx);       // run it (L212)
    case 'edit':    return execute({ ...proposal, ...decision.changes }, ctx);  // adjusted (L208)
    case 'deny':    return replan(ctx, 'denied: ' + decision.reason);           // re-plan (L202)
  }
}

What the reader must SEE — the threshold, the gate, the record:

  RISK.read_only → runs free · RISK.gated → the gate (L315, L208)
  checkpoint before the gate → resume the exact action (L207)
  humanApprove(request) → the action + the reasoning (L203)
  logDecision() → the audit trail (L322, L324)

  The human is in the loop at the consequential moments.

• The gate is a latency pause (L151). A gated action waits for the human — the TTFT story (L145) includes the approval time; the pause is the price of the control (L208).
• The threshold is the friction control (L150). Too many gates → the human is the bottleneck (L151) — the threshold (L315) is a throughput design (L208).
• The checkpoint is the cheap insurance (L255). An atomic write before the gate (L207) — microseconds, next to the approval wait (L151).
• The record is storage (L150). Decision logs (L322) are cheap and auditable — the governance requirement (L373).

• HITL = approval gates, interrupts, takeover (L208).
• The threshold: read free, consequential gated (L212, L315).
• The gate shows the action + the reasoning (L203, L213).
• The checkpoint brackets the gate (L207) — approve/edit/deny resume cleanly (L255).
• Every decision is recorded (L322) — the accountability (L324).
• The gate is the answer to excessive agency (L212).

HUMAN-IN-THE-LOOP = the accountability architecture

THE THREE PATTERNS (L208)
  approval gate   the agent proposes, the human approves — for
                  consequential actions (L212)
  interrupt       the human stops or redirects the loop (L205)
  takeover        the human continues the task (L207)

THE THRESHOLD (L212, L315)
  read actions    run free (L201)
  consequential   gated — refund, transfer, publish, delete
  the line is consequence + irreversibility (L212)

THE GATE'S MECHANICS (L207, L203)
  checkpoint before the gate — approval resumes the exact action (L255)
  the human sees the action + the reasoning (L203) + the trace (L213)

THE RECORD (L322, L324)
  every decision logged — approve, edit, deny
  the loop is accountable because the human can say no

THE COMPOSE (L216)
  the gate answers excessive agency (L212)
  the interrupt answers drift (L211)
  both are part of the guardrails (L209)

INTERVIEW, 4 MOVES
  1 patterns "gates, interrupts, takeover (L208)"
  2 threshold "read free, consequential gated (L315)"
  3 mechanics "checkpoint + context — approve/edit/deny (L207, L203)"
  4 record   "the audit trail is the accountability (L322)"

You now hold the control architecture: the approval gates at the consequential moments, the interrupts that redirect, the takeover that hands over, and the logbook that records it all. The agent's power is now accountable — the human is in the loop exactly where it matters (L324).

Next: the rails around the whole loop — guardrails for agents (L209), before, during, and after.