Human-in-the-loop AI agents: a practical guide
Design human-in-the-loop AI agents with enforced permissions, action previews, approval queues, and clear escalation paths for connected business systems.
A practical guide from Shivaantha · General guidance, not a report of client results.
Separate a suggestion from an action.
An assistant that drafts a reply and an agent that sends it have different risk profiles. The same is true of suggesting a record update versus changing the record. A clear design treats reading, recommending, and executing as separate capabilities.
Define permissions at the tool and application level. A prompt saying “ask permission first” is not an authorization boundary. The system performing the action should enforce the approval requirement independently of the model’s response.
Give a reviewer the context to decide.
Review is not meaningful if the person sees only a confident sentence and an approve button. Show the proposed action, the affected record, the evidence used, and important uncertainties. Make edits and rejection as straightforward as approval.
For consequential changes, consider whether approval should expire or be checked again if the underlying record changes. A person should not inadvertently approve a different action from the one they reviewed.
Design the exception queue as carefully as the happy path.
Specify who receives an escalation, what information arrives with it, and what happens if nobody responds. Without ownership and time expectations, an exception queue can become a hidden backlog.
Escalation should cover missing information, conflicting instructions, unavailable tools, and requests outside the agent’s scope. A model’s self-reported confidence is not a reliable substitute for these explicit conditions.
- Use clear action previews and source context.
- Keep high-impact operations behind enforced approval.
- Define fallback behavior when tools or reviewers are unavailable.
- Avoid duplicate actions when a request is retried.
- Provide a way to pause the workflow and investigate.
Measure the quality of oversight.
Track what reviewers correct, reject, or escalate. If people approve everything because the queue is overwhelming, the process may provide the appearance of control without the substance.
Use recurring failures to revise the agent’s scope or improve the underlying data. Automation should remove unnecessary work, not turn people into a last line of defense for a poorly bounded system.