Name and describe three distinct patterns for human in the loop approval in an agent workflow. For each, describe the latency/safety tradeoff.
Human-in-the-loop patterns sit at three timeline points: approve before execute, edit and continue, or review after the fact. Pick by action reversibility, not by feel.
Imagine a new assistant booking your travel. You could make them check with you before every single click, which is safe but slow. You could let them book everything and then read the receipts later, which is fast but a booked flight is hard to cancel. Or you could tell them to act on their own for cheap, refundable things and only knock on your door for the big, non-refundable ones. A fourth option is to let them ask for help only when they are unsure. The right choice depends on how easy it is to undo a mistake. Sending money is hard to undo, so check first. Drafting an email is easy to undo, so let them draft and you fix it later. Good systems mix these, not pick one for everything.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
A human in the loop design decides where a person sits relative to an agent's actions, and how much of the workflow runs without supervision. The naive question is whether to have a human approve things at all. The real question is sharper: which actions, at which point in the loop, and why. Treat the answer as a per-action policy, because a single global setting is always either too slow or too dangerous.
The agent loop emits a stream of tool calls. A human can be inserted before an action runs, woven into the action by editing it, or placed after the action as a reviewer. Each position trades latency against safety differently, and the correct choice is governed by how reversible the action is. A drafted email and a sent email are the same content with opposite reversibility, and they demand different gates.
The four patterns below are not competitors you choose between once. They are tools you compose. A serious agent applies different ones to different tools in the same workflow, and the engineering effort goes into deciding the routing and into building the undo windows that let you safely loosen a gate.
Approve before execute: the safe, slow default
In approve before execute the runtime pauses the loop before a tool call and waits for a human to confirm. Nothing risky reaches the outside world without sign-off, which makes it the safest pattern by construction. Frameworks implement it as an interrupt: the agent serialises its proposed action and state, the loop suspends, and a person resumes it with an approve or reject. Crucially the agent state must be durable across the pause, because a human may take minutes or hours to respond, and the process that started the run may not be the one that finishes it.
The cost is latency and throughput. The loop is idle while the human deliberates, so end to end time now includes human response time. This is fine for low-frequency, high-stakes actions like wiring money or deleting a production table, where a few seconds of human attention is cheap relative to the downside. It is a poor fit for a chatty agent that makes dozens of cheap reversible calls per task, where the human becomes the bottleneck and the agent's speed advantage evaporates.
The failure mode is overusing it. Gate every tool call and a fast agent becomes a slow one, and the human is interrupted so often they stop reading. That is the on-ramp to approval fatigue, covered below. The discipline is to apply this gate narrowly, to the irreversible high-impact tail of actions, and to leave the common path ungated.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- LangGraph ships an interrupt primitive that pauses a StateGraph before a chosen node, the canonical approve before execute gate, and resumes with human-edited state for edit and continue.
- Claude Code asks before running shell commands or editing files, but lets you allowlist safe commands so only risky tool calls interrupt, an escalate on threshold pattern in practice.
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you classify which actions need a blocking pre-action gate versus async post-hoc review?
Build a reversibility and blast-radius matrix per tool. Irreversible plus high impact gets a blocking gate; reversible plus low impact goes async. For the middle, engineer an undo window to demote the action to async.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Picking one approval pattern for the whole agent. The right design routes each action type to a different gate based on how reversible and how costly that action is.
60 second bullets to scan on the way to the call.
Name the three core timeline positions for a human checkpoint and what each implies for supervision.
Explain why reversibility, not preference, is the primary variable for choosing a gate.
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.