DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix Now×
FREEDOM251

Freedom251 › Blog › agent safety

How to Build Human-in-the-Loop Checkpoints for AI Agents

By Freedom251 Team · · 12 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

Make an AI agent stop before an action when the result could be consequential, irreversible, sensitive, ambiguous, or dependent on human judgment. The agent should gather evidence and prepare an exact proposal, then pause at a technically enforced checkpoint. A person must be able to approve, reject, revise, or provide missing information; silence and timeouts must never count as approval. Low-risk, reversible, well-specified work can remain automatic, with guardrails for routine validation.

This design is called human-in-the-loop (HITL). Done well, it limits harmful side effects without forcing a reviewer to approve every harmless tool call. The sections below show where to place checkpoints, what an approval request must contain, how to persist and resume a paused run, and how HITL differs from human-on-the-loop monitoring.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What does human-in-the-loop mean for an AI agent?

HITL is a control boundary inside an agent workflow. The agent reaches a predefined checkpoint, calls an external interaction system, and waits while a person reviews its proposed work. Only an explicit decision lets the workflow continue. Google Cloud Architecture Center describes the pattern as integrating intervention points directly into the workflow so the agent pauses and waits for a person to review its work.

The checkpoint is more than a chat message asking, “Should I continue?” It must sit between preparation and the side effect in the execution path. The service that performs the action should verify an approval decision and the identity of the approver before it accepts the tool call. If the approval service is unavailable, the safe behavior is to remain paused rather than execute.

#1 Best Overall
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter | 4Pack Type C Female to A Male Cable Converter for Apple Duo 17 16 15 14 Plus,iWatch Watch 12 11 10,iPad 9 8 Air,Airpods 5 4
  • Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
  • Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
  • Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
  • Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
  • 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.

A useful separation is:

  • Agent reasoning: collect facts, inspect files, calculate options, and draft a proposed operation.
  • Approval boundary: present the operation, scope, evidence, risks, and uncertainty to an authorized person.
  • Effectful execution: perform the approved call with the exact arguments that were reviewed.

Human approval is therefore a policy decision, not a personality trait of the model. The Canadian Centre for Cyber Security advises that system designers or operations teams—not the agent itself—define when approval is required.

When should an AI agent stop and ask for approval?

Stop when an error would create material harm or when a person must resolve information the agent cannot safely infer. Use the following triggers as policy rules, then combine them with your organization’s permissions and risk tolerance.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

High-consequence or irreversible effects

Require approval before deleting critical records, resetting systems, changing permissions, sending external communications, publishing content, cancelling services, transferring money, or causing network egress. The Canadian Centre for Cyber Security specifically identifies system resets, network egress, and deletion of critical records as situations where prior approval may be appropriate.

Reversibility matters. A draft saved in a private workspace can usually run automatically; an action that sends the draft to customers, overwrites the source, or triggers a charge should cross a gate. “Undo” is not enough if recovery is slow, incomplete, or unavailable.

Ambiguous or incomplete intent

Pause when the request does not establish the goal, audience, scope, deadline, or acceptable trade-off. An agent should ask a focused clarification question rather than choose a consequential interpretation. In Anthropic’s analysis of interactive Claude Code sessions, 13% of sampled self-stops were used to clarify vague or incomplete requests.

Missing context, credentials, or diagnostic evidence

Ask for the minimum information needed to proceed safely when logs, test results, environment details, credentials, tokens, or access rights are missing. Anthropic reported that 21% of sampled self-stops gathered diagnostic information or test results and 12% requested missing credentials, tokens, or access.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Do not ask a reviewer to paste secrets into an approval form. Use a controlled secret store or an access request that records which permission is needed and for how long.

Subjective judgment or release decisions

Use HITL when policy cannot determine the answer reliably: approving a sensitive summary, deciding whether a communication is suitable for a particular audience, selecting between value-laden options, or authorizing release of a dataset. The agent can prepare alternatives and evidence, but the accountable person makes the final call.

Rank #2
Sale
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter | USB C Dongle with 90W Max Power Delivery, 3×5Gbps USB A Data Ports, for MacBook, Dell, and More (Charger Not Included)
  • 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
  • 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
  • Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
  • 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
  • What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.

Sensitive or adversarial conditions

Pause when prompts may be malicious, data is confidential, or tool arguments could affect security. Microsoft recommends meaningful human control and approval for high-risk or irreversible actions, with visibility into the plan and tools involved. A gate is especially important when untrusted text can influence a shell command, URL, recipient list, permission change, or data export.

How do human-in-the-loop, human-on-the-loop, and autonomous operation differ?

The three modes differ in where the person sits in the control path. NCSC guidance uses the following distinction:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Mode Person’s role Suitable conditions Main risk
Human-in-the-loop Must approve, reject, revise, or answer before the side effect High consequence, low reversibility, sensitive data, or unresolved judgment Reviewer delay and workflow complexity
Human-on-the-loop Monitors execution and can intervene while the agent operates Moderate risk, strong automatic controls, rapid rollback Intervention may arrive after harm begins
Human-out-of-the-loop No routine intervention; the agent operates autonomously Low-risk, reversible, well-specified tasks with tested guardrails Errors can propagate before detection

Choose a mode using consequence severity, reversibility, uncertainty, sensitivity, expected reviewer latency, and the cost of interrupting work. Concentrate approvals at high-consequence boundaries; asking for confirmation on every harmless read or formatting step trains reviewers to click through prompts.

What is the safest checkpoint workflow?

A reliable checkpoint has six stages. The pause must be durable, and the effectful tool must not be callable through a second path that bypasses the gate.

  1. Prepare: let the agent inspect permitted sources, gather evidence, and draft the proposed operation without executing its side effect.
  2. Explain: show the exact operation, target, arguments, required permissions, expected effects, uncertainty, and supporting evidence.
  3. Ask explicitly: provide separate approve, reject, and revise or clarify choices. Treat silence, a vague acknowledgement, a closed browser tab, and a timeout as no decision.
  4. Persist the pause: save the pending request, workflow state, proposal hash or version, expiration policy, and the identity of the requesting agent. Microsoft’s typed RequestPort emits an external request event; OpenAI’s Agents SDK exposes pending interruptions and can serialize a RunState.
  5. Resume safely: after approval, continue from the interrupted step using the reviewed arguments. After rejection, return a structured reason to the agent and require a revised proposal when appropriate. OpenAI documents approve/reject and resume behavior for the same top-level run.
  6. Audit: record who approved, what they saw, the decision, timestamp, policy version, and resulting tool call. Store rejection reasons and revisions so operators can identify recurring ambiguity or unsafe proposals.

What should an approval request show a reviewer?

A reviewer should be able to make a decision without reconstructing the agent’s entire context. Display the information that determines risk and scope.

  • Action: a plain-language summary such as “Delete 184 records from the production customer table,” followed by the exact tool or API operation.
  • Target and scope: environment, account, recipient list, file paths, record counts, date ranges, and affected permissions.
  • Arguments: the structured parameters that will be sent, not only a natural-language paraphrase.
  • Expected effect: what changes immediately, what downstream systems may be triggered, and whether recovery is possible.
  • Evidence: logs, test results, source documents, or calculations used to form the proposal, with timestamps where freshness matters.
  • Uncertainty: missing fields, conflicting sources, confidence limits, and assumptions.
  • Alternatives: safer or narrower options when the agent identified them.
  • Identity and policy: the requesting agent, user or service account, required permission, policy version, and approval deadline.

Use a distinct control for each decision. “Approve all” should not silently authorize later tool calls whose targets or arguments have changed. If a proposal changes after review, invalidate the old approval and create a new request.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How should guardrails and human approval work together?

Guardrails perform automatic checks; HITL supplies authorization or judgment. They are complementary, not interchangeable.

Control What it can do automatically When a person is still needed
Input guardrail Validate schema, reject disallowed requests, classify sensitivity, and limit prompt content The request is ambiguous, high impact, or requires a value judgment
Output guardrail Check format, redact prohibited data, enforce policy filters, and detect unsafe content A person must decide whether a sensitive result is fit for release
Tool guardrail Validate argument types, permitted targets, rate limits, and allowed operations The call creates an irreversible or high-risk side effect
HITL approval Authorize, reject, revise, or clarify a proposed action Use it at the consequential boundary, after automatic checks pass

OpenAI guidance maps automatic guardrails to validation and human review to approval decisions for cancellations, edits, shell commands, and sensitive MCP actions. A callable approval rule should fail closed: OpenAI documents that malformed or non-object tool arguments require manual approval instead of being auto-approved.

Rank #3
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter | 85W Max PD, 2 USB 3.0 & 1 USBC Data Ports, SD/TF Card Reader, for Laptops/Mac and Other Type C Devices (Charger Not Included)
  • Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
  • Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
  • Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
  • Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
  • What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.

How can an implementation pause and resume without repeating a tool call?

Model the approval as a durable workflow state, not as a transient conversation turn. The pending state should identify the interrupted operation and preserve the exact reviewed arguments.

Microsoft Agent Framework

Microsoft Agent Framework provides a typed RequestPort that pauses a workflow and emits an external request. A response to that request resumes the next executor. The same request/response mechanism can be used for tool approval, so the approval service becomes part of the workflow rather than an informal message channel.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

OpenAI Agents SDK

In the OpenAI Agents SDK, mark a tool as requiring approval. When the run returns an interruption, convert the run to RunState, present the pending approval, then approve or reject it and resume the original top-level run. Keep the run identifier stable so the resumed execution has the same context and does not start a second independent run.

Idempotency and replay protection

Even with a durable state object, a worker may crash after the external system accepts a request but before the workflow records success. Give each effectful operation an idempotency key derived from the run and proposal version, and have the receiving service reject duplicate keys or return the original result. Before resuming, verify that the target, arguments, permission, and policy version still match the approved record.

Do not automatically replay a failed side effect merely because the workflow resumed. Classify the failure: a validation error needs a revised proposal, a transient transport error may be retried with the same idempotency key, and an unknown outcome requires reconciliation with the target system.

How should approval policies be written?

Write policies as deterministic conditions that operations can test and audit. A policy should name the action, scope, risk threshold, approver role, expiration, and fallback behavior.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Action example Default mode Approval condition Fallback if no response
Read a non-sensitive internal document Autonomous Input and access guardrails pass Stop on access or policy error
Modify a draft in a private workspace Human-on-the-loop Automatic versioning and rollback available Pause if scope expands
Send an external message HITL Recipient list, content, and attachments are reviewed Remain pending; never send
Delete production records or reset a system HITL Authorized operator confirms exact target and recovery plan Remain pending and alert operations
Transfer funds or change privileged access HITL Required separation of duties and transaction limits pass Reject or escalate according to policy

Separate who designs the rule from the agent that executes it. Review policies when tools, environments, data classifications, or regulatory obligations change. Version the policy and include that version in every approval record.

What does published interruption data suggest about agent design?

Anthropic analyzed a sample of 500,000 human interruptions and 500,000 completed turns in interactive Claude Code sessions. The reported self-stop categories were:

Rank #4
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray | Data transfer & Fast charging for MacBook, iPhone 17/16/15, iPad, Samsung Galaxy, Apple Watch
  • Dual Converters, Infinite Potential:Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
  • Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
  • Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
  • Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
  • Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Reason for the stop Share reported by Anthropic
Present a choice between proposed approaches 35%
Gather diagnostic information or test results 21%
Clarify a vague or incomplete request 13%
Request missing credentials, tokens, or access 12%
Get approval or confirmation before taking action 11%

Anthropic also reported that humans interrupted Claude Code 32% of the time to provide missing technical context or corrections. These figures describe sampled interactive coding sessions, not every agent workload, and should not be treated as universal probabilities. They do show why a useful interruption system needs more than a single approve button: agents often stop to obtain context, diagnostics, or a choice between alternatives.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What are common HITL failures and how do you fix them?

The agent asks after the side effect

Symptom: a message is sent or a record is changed before the reviewer sees it. Fix: split the workflow into a non-effectful proposal tool and an effectful execution tool, and enforce authorization in the execution service.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Silence is treated as consent

Symptom: a timeout or closed approval window triggers execution. Fix: define only an explicit, authenticated approval as success; otherwise keep the request pending, reject it, or escalate.

The reviewer cannot tell what will happen

Symptom: the prompt says “Run cleanup” without targets, arguments, or impact. Fix: expose the exact operation, scope, expected effects, evidence, and uncertainty before offering a decision.

Approval is reused after the proposal changes

Symptom: a revised command executes under an earlier approval. Fix: version or hash the proposal and bind approval to that version; any material change creates a new checkpoint.

Paused work disappears

Symptom: a worker restart loses the pending request or starts the agent from the beginning. Fix: persist workflow state and the external request, then resume the interrupted step from the same top-level run.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Reviewers approve everything

Symptom: high interruption volume produces habitual clicking and slow operations. Fix: move reversible, low-risk steps to automatic guardrails, batch genuinely related low-risk approvals when policy allows, and reserve gates for consequential boundaries.

Malformed arguments bypass review

Symptom: an approval rule fails open when tool arguments are missing or have the wrong type. Fix: reject or route malformed and non-object arguments to manual approval, as documented in OpenAI’s approval guidance.

Best Value
Sale
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display | 85W Max PD, 1 Powered USB-C 5Gbps & 2 Powered USB-A 3.0 5Gbps Data Ports, for MacBook Pro, MacBook Air, Dell and More (Black)
  • 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
  • Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
  • Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
  • HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
  • What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.

How do you operate HITL at scale?

Track both safety and service quality. Useful operational measures include approval latency by action type, rejection and revision rates, expired requests, duplicate-call attempts, policy violations blocked by guardrails, and the percentage of approvals where the reviewed proposal differed from the executed call. A high revision rate usually signals unclear user intent or poor proposal presentation, not merely slow reviewers.

Route requests to people with the right authority and context. A financial transaction, a production reset, and a customer-facing publication may require different approver roles. Enforce separation of duties where one person should not both create and approve a high-impact change.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Set explicit expiration behavior. A request can become unsafe as credentials, data, prices, recipients, or system state change. On expiration, revalidate the proposal or require a new one; do not silently execute an old approval.

Protect the approval interface itself. Authenticate the reviewer, authorize the decision, prevent cross-tenant display of targets, and log the evidence shown. Treat approval links as sensitive capabilities rather than ordinary notifications.

HITL implementation checklist

  • List every tool that can send, delete, purchase, publish, reset, export, edit, or change permissions.
  • Classify each operation by consequence, reversibility, uncertainty, sensitivity, and required authority.
  • Choose autonomous, human-on-the-loop, or HITL operation for each class.
  • Place the gate before the side effect and enforce it in the tool or service boundary.
  • Show exact targets, arguments, permissions, expected effects, evidence, and uncertainty.
  • Provide explicit approve, reject, and revise or clarify outcomes.
  • Fail closed on timeout, missing decisions, malformed arguments, and unavailable approval services.
  • Persist the pending request and workflow state, with proposal versioning and idempotency keys.
  • Resume the interrupted step rather than starting a second top-level run.
  • Record approver identity, timestamp, policy version, reviewed proposal, decision, and resulting call.
  • Test crashes, duplicate delivery, changed targets, expired approvals, rejected proposals, and unknown external outcomes.
  • Review interruption and revision metrics to improve policies and the agent’s requests.

Frequently Asked Questions

Can an AI agent ask for approval in a chat message alone?

A chat message can notify a reviewer, but it is not sufficient control by itself. The effectful service must verify an authenticated decision tied to the exact proposal, and the workflow must remain paused if the message is ignored or altered.

Who should be allowed to approve an agent’s high-risk action?

Use the role that owns the affected system or decision, and enforce least privilege and separation of duties where required. The approval record should identify the person and authority used, not merely a display name.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What should happen if the system changes while an approval is pending?

Re-check the target, permissions, policy version, and relevant evidence before execution. If any material input changed, invalidate the old decision and ask the agent to create a fresh proposal.

How can teams reduce reviewer fatigue without removing safety gates?

Measure which requests are routinely approved and whether they are reversible, then move eligible low-risk cases behind automatic guardrails. Keep high-impact actions individually reviewable and improve the request’s evidence and scope so decisions are faster.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

agent safetyAI agentsAI governanceHuman-in-the-LoopTool approvalworkflow automation

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.