Main area
Agency
ki-orchestrierung

Human-in-the-Loop — Approval Gates for AI Agents

Redaktion ·

Human-in-the-loop just means this: a person sits at the decisive point in the workflow and gives the green light before the AI agent runs an action that can’t be undone. The agent plans, proposes, prepares everything — and then pauses until you nod. It sounds like a brake, and it is one. At certain points, though, a brake is exactly what you want.

Why put a human in the middle at all

An agent runs its loop: the model thinks, calls a tool, looks at the result, thinks again. For research that’s harmless — worst case, it reads the wrong page. For “delete this table” or “transfer the amount,” things look different. A slip here isn’t annoying, it’s expensive and often final.

Language models hallucinate, misread instructions, or get knocked off course by manipulated inputs. As long as the actions are reversible, you can catch that after the fact. With irreversible actions, there is no after the fact. And that’s exactly where it clicks: you need a point where a human takes a look before things get serious.

What an approval gate actually is

An approval gate is a spot in the workflow where the agent stops and waits for a human decision. Technically, here is what happens:

  1. The agent wants to call a tool that’s marked as critical — say “delete file” or “send email.”
  2. Instead of running the tool straight away, the runtime interrupts the workflow and freezes the state.
  3. It shows you what’s about to happen: which tool, with which parameters, and on what reasoning.
  4. You decide — approve, reject, or adjust.
  5. Your answer is fed back into the agent’s context, and the workflow resumes from the frozen point.

The important part: the agent isn’t burning cycles in an endless loop waiting for you. Its state is saved (in LangGraph, for example, via a checkpointer), so the pause can last minutes or even hours. That’s practical, because people rarely reply within seconds.

Where to place gates — and where not to

Not every action needs approval. If you sign off on every single step, the agent moves as fast as an intern who asks about every line — and the point of automation is gone. The rule of thumb is reversibility:

  • Reversible (write a draft, read data, run a search): let the agent run. You just throw a bad draft away.
  • Irreversible or expensive (delete data, move money, change a production system, communicate outward, touch configuration): place a gate. Here a mistake can’t be undone.

This is the same split that underpins clean agent architectures — more on that in building AI agents and in multi-agent orchestration, where several agents work in parallel and a single gate protects the whole pipeline.

The latency problem

A gate has a price: as long as the human hasn’t answered, the workflow stands still. If someone takes twenty minutes to review, the whole thing stalls for twenty minutes. In practice, three things help.

First, batch approvals: instead of ten separate sign-offs, you collect them and present them together. Second, ship enough context: someone who can see at a glance what should happen and why decides in seconds rather than minutes. Third, timeouts with a safe default: if no answer comes within a set window, the gate falls back to the safe option — usually “don’t run it.” That way the agent doesn’t hang forever, and still does nothing risky.

How to put HITL into practice

You don’t have to reinvent the wheel. Agent frameworks already ship approval gates. In LangGraph, for instance, an interrupt call suspends execution, hands control back to your application, and accepts the human’s reply. The checkpointer makes sure the state survives the pause.

If you build your own, you follow the same logic: mark critical tools, intercept their call before execution, present it to a person, and only run it after approval. It’s also important to log every decision — who approved or rejected what, and when. You’ll need that later for traceability, and for audits if it comes to that.

FAQ

Is human-in-the-loop the same as a chatbot that asks follow-up questions?
No. A chatbot asks in order to understand the task. An approval gate asks in order to sign off on an already-planned, critical action. The difference is timing: the gate sits right before an irreversible action runs, not at the start of the conversation.
Won't HITL slow my agent down massively?
Only if you put gates in the wrong places. Reversible steps don't get a gate. Place them solely before irreversible actions and ship enough context, and the speed cost is small — while the protection you gain is large.
What happens if nobody responds to the approval?
That's what a timeout with a safe default is for. If the window expires without a decision, the agent doesn't run the action — it aborts or sets it aside for later review. The default is always the harmless option.
Do I need HITL if my agent only reads and writes text?
Usually not. Reading and drafting are reversible — you throw a bad draft away. Gates start to pay off once the agent runs outward-facing actions: send, delete, pay, publish, change systems.
How does HITL relate to prompt security?
Closely. If an agent gets hijacked through manipulated inputs, the approval gate is often the last line of defense before damage is done. More on that in [prompt security](/en/agency/lexikon/prompt-sicherheit/).

Themenuebersicht

KI-OrchestrierungWorkflow-Automatisierung