Human-in-the-loop, when not to automate everything
Where AI agents must ask humans. Where they're allowed to decide alone. A clear rule for both.
The question behind the question
You've built an agent that solves tasks. At some point the question comes up: do you let it run, or does it have to ask at certain steps? Answer: it depends. But on what exactly. That's this lesson.
The three modes
There are three operating modes for any agent:
- Full autonomy. Agent decides, executes, reports afterwards. No approval step.
- Draft-first. Agent creates a draft, places it for your approval, executes only after "yes".
- Halt on uncertainty. Agent runs autonomously by default but stops itself when it senses uncertainty or the decision is too big.
The beginner's mistake is to build everything in mode 1 because it looks faster. The paranoid's mistake is to build everything in mode 2 because it looks safe. The right way: decide per action. Not per agent.
The reversibility criterion
The only rule that works: the harder an action is to undo, the sooner a human has to look at it.
-
Easily undone: drafting an email. A note entry. Raw research. File rename in a working folder. → Full autonomy fine.
-
Mid-undo: calendar entry. A post draft in the queue. A database row in your own system with an undo button. → Full autonomy fine, but build an undo button or log events.
-
Hard to undo: sending an email to customers. Triggering a payment. Uploading a file to a public domain. Database deletes without backup. External API call that costs money. → Always draft-first. Always approval step.
-
Not undoable at all: public LinkedIn post. Bank transfer. Customer contract counter-signing. Database schema migration. → Two-eyes principle. Ideally agent creates, human reviews, second human confirms. Solo: draft-first with a time buffer ("read again tomorrow").
What the approval step looks like in practice
The agent doesn't write its draft straight out, but into a queue. You see the queue at a place you visit regularly (mail inbox, Notion page, dedicated web UI). You click "Send" or "Discard". Only after your click is it executed.
That sounds expensive but it isn't. The time loss is small. The trust gain is big. And you train your agent on the side, because each rejection you can explain why, and the next run gets better.
Where the agent itself has to pause
Even on actions in the "easily undone" category, the agent itself should stop when:
- It sees a decision not clearly covered by its instructions.
- It notices it's working with data it can't uniquely identify (e.g. "which customer is meant, there are three Smiths").
- A previously working step suddenly throws an unexpected error.
- It's making an external change it can't undo on its own.
That's not a deficit. That's the indicator of a mature agent.
The anti-pattern to avoid
Nothing's worse than an agent that asks about every little thing. "Should I set the email subject as 'Update' or 'Weekly report'?" That's not human-in-the-loop, that's just under-specified instructions. The agent should be able to decide that itself, you gave it a role, it fills the role.
Asking is legit on: risk, real ambiguity (not contrived), external influence (time window expired, source not reachable). Asking is bad on: details the agent can derive itself.
Rule: if you grumpily nod off every question, your agent needs calibration. Crank up autonomy. If on the other hand you're glad you were asked and the decision was important, exactly right.
Two practical examples
Email agent for customer inquiries. Reads incoming mails, classifies, drafts a reply. Mode: draft-first. The agent doesn't reply itself, it puts the reply in the "Drafts" folder. You read in the morning, click what should go out. The agent never sends itself, because you never want to send an embarrassing AI mail to a customer without proofreading.
Search agent for research. Compile materials on a topic. Mode: full autonomy. It can open arbitrary websites, read PDFs, collect quotes and return a report. The damage if it reads something wrong is zero, the time gain is large. You review in the output, not in the process.
Same architecture, completely different settings. Because the actions are critically different.
Why legal wants it that way too
EU AI Act, Article 14, requires human oversight for "high-risk" systems. What counts as "high-risk" is its own chapter. But the logic behind the article is exactly this: on far-reaching decisions a human has to be able to look. Not a tech question, a legal requirement.
That means: if you build an agent that takes decisions about people in the SME space (applications, terminations, credit scoring), human-in-the-loop isn't optional. It's mandatory. And must be documented.
How to start today
Go through your existing agents, or the processes where you want to build one. Per process:
- List the individual actions the agent will take.
- Rate each action on the reversibility scale (easy / mid / hard / not at all).
- For everything "hard" or "not at all": build draft-first.
- For "easy": full autonomy fine.
- For "mid": undo mechanism or event log.
That's ten minutes per agent and saves you an embarrassing situation three months later.
Onwards
Level 6 Lesson 4 goes deeper into deployment of agents and servers including the technical mechanics behind approval loops. And in the Academy blog (when you read this) there's also an article about how we built human-in-the-loop into our own agent fleet at StudioMeyer.