# Human-in-the-loop: when a person should decide in an AI workflow > Human-in-the-loop is a design where a person approves, corrects or interrupts an AI system's work at defined points. When to add it, where and how. *Tags: ai, agents, human-control, ux* --- > [!info] Quick Definition > **Human-in-the-loop** is a design for AI systems in which a person takes part at defined points of the work: approving an action, reviewing a result or correcting before something is applied. It does not mean watching every step, but deciding at the points where a mistake costs the most. ## Why does an agent need a person? An agent can run chains of actions: reading files, calling tools, writing changes, sending messages. Each step can look reasonable, while the whole may drift away from what the person wanted. A model can be confidently wrong, and it does not always know when it was. The person brings what the system does not have: the context of the customer relationship, the team's tolerance for risk, information that is not in the files, and judgment about what is acceptable. Human-in-the-loop is the way to put that judgment into the flow without slowing everything down. There is a useful distinction between two kinds of intervention. **Approval** happens before an action, and the person can prevent it. **Review** happens after, and the person can correct or undo. Each one needs a different design. ## Where should the intervention go? Not every step deserves a pause. A practical test is to look at three things for each action: 1. **Is it reversible?** Reading a file or generating a draft in memory can be thrown away. Sending an email or deleting data cannot. 2. **Does it have an effect outside the system?** An action that reaches a customer, a payment or another system deserves control. 3. **Can the system verify its own result?** If a test or a rule confirms the output, human review can be a sample. If nothing confirms it, a person must review. These three tests make a simple map: reversible work with no external effect runs alone; irreversible or external work is approved; whatever nobody can verify is reviewed. ## How is the pause implemented? A system with human-in-the-loop needs three pieces: - **Stop.** Execution pauses when it reaches a checkpoint, without continuing by inertia. - **Saved state.** The task keeps its context, its tools and the pending action, so it can resume later. - **Recorded decision.** Approval or rejection is attached to the action, with who decided and when. The OpenAI Agents SDK documents this flow: when a tool requires approval and no decision is stored, execution pauses and returns the pending interruptions. The application approves or rejects each one and resumes from that state. A tool can be marked as always requiring approval or decide per call, and if the arguments cannot be inspected safely, the SDK asks for manual approval. The documentation warns that restoring the serialized state does not authenticate the reviewer, so approval must be validated on the server: authenticate whoever decides, check they are authorized for that run, and prevent replayed or concurrent resumes. It also notes that approval does not guarantee the action runs exactly once: if a crash happens after the tool acted but before the state was saved, resuming can repeat the action, so consequential tools should use idempotency keys. Claude Code applies a similar idea through its permission modes. In Manual mode (`default`), it asks for confirmation before most actions that edit files, run shell commands or reach the network, and only reads files without asking. Other modes move the control: `acceptEdits` lets edits through, and in `auto` a classifier reviews actions instead of the person. Each mode is a decision about where to put the pause. ## When should you NOT put a person in the loop? - **In low-risk, fully reversible tasks,** such as formatting text or sorting notes. A pause there only costs time and patience. - **When there are so many pauses that people approve without looking.** That is the worst case: apparent control with no real control. If people approve ninety percent without reading, reduce the checkpoints and improve what is shown. - **When the pause comes too late.** Asking for approval after the action already happened is not control, it is a notification. Human-in-the-loop is the framework; each checkpoint has its own page. For approving one concrete action, see [[action-approval|approval of agent actions]], and for how permissions appear on screen, [[agent-permissions-ux|permissions UX for agents]]. When the decision must pass to someone on the team, [[human-handoff|AI-to-human handoff]] describes that transfer. And the technical limits that contain the agent even when nobody approves anything are in [[sandboxing-and-permissions|sandboxing and permissions]]. ## Example Illustrative example: an agent helps a support team answer tickets. It can read the history, draft replies and tag cases without a pause, because nothing leaves yet. Before sending a reply to a customer, or closing a ticket with a refund, the agent stops and shows the pending action with its justification. A week later, the team notices the agent asks for approval for every tag, and that reviewers accept almost everything. They remove the pause from tags, keep the one for sending and the one for refunds, and add a weekly sample of automatic replies to review. Control stays where the risk is. ## How do you measure whether the control works? Each month, ask three questions: what percentage of approvals are accepted without changes, how many errors were caught in review, and how many reached the customer or the external system. If nearly every approval is accepted and no error is caught before it leaves, the control is decorative. If many are rejected, the agent needs better plans, not more questions. Track these numbers by action type as well, because a control can be useful for payments and pointless for labels. ## Common mistakes - Putting a pause on every step and ending up with automatic approvals. - Asking for approval after the action already had an external effect. - Showing the person an action without the context to decide. - Not recording who approved what and when. - Trusting the saved state without validating on the server who may approve. ## Sources - [Human-in-the-loop (OpenAI Agents SDK, documentation)](https://openai.github.io/openai-agents-python/human_in_the_loop/) - [Choose a permission mode (Claude Code, documentation)](https://code.claude.com/docs/en/permission-modes) - [Configure permissions (Claude Code, documentation)](https://code.claude.com/docs/en/permissions) --- Source: https://www.fernandoux.com/en/wiki/ai/human-in-the-loop/