Human-in-the-loop (HITL) for AI agents
Human-in-the-loop (HITL) in AI means a person approves, rejects or corrects an AI system's work before it takes effect. Here's how it works for AI agents.
What is human-in-the-loop (HITL) in AI?
Human-in-the-loop (HITL) in AI is a design pattern where an AI system stops at a defined point and waits for a person to approve, reject or correct its work before that work takes effect. The person is a required step in the system's control loop, not an observer.
What the person reviews depends on the kind of AI system:
- Machine learning models: the person labels training data or corrects low-confidence predictions.
- AI agents: the person approves an action before it runs, usually a tool call such as a refund, a database write or a deploy.
In 2026, most human-in-the-loop discussions are about AI agents. That's because an agent doesn't just suggest an action, it takes it. Once a wrong refund goes out, there's nothing left to review. This page focuses on human-in-the-loop for AI agents.
How human-in-the-loop works for AI agents
Most systems follow the same five steps, whatever the agent is built with.
- Intercept. The agent calls a tool as usual. Before the tool runs, a hook, middleware, proxy or workflow step holds the call. The table below shows which one each kind of agent uses.
- Evaluate. Rules decide whether the call needs a person. They can check the tool name, the MCP server or the arguments, such as a refund over $20. Low-risk calls can be configured to run without review.
- Pause. The system saves the pending call with its exact arguments, so it can wait for a decision. Frameworks save the paused run, such as a LangGraph checkpoint or an OpenAI Agents SDK
RunState. Approval services store a request with a deadline. - Decide. A reviewer approves or rejects the call in a terminal prompt, a chat app such as Slack, or a review app. Some systems also let the reviewer edit the arguments first.
- Resume or block. Approved calls run. Rejected calls return an error to the agent, which can change its plan. A call nobody answers should expire and count as rejected.
Where the call is intercepted
| Kind of agent | Where the call is held | Examples |
|---|---|---|
| Coding agents | A hook that runs before each tool call | Claude Code and Codex PreToolUse, OpenClaw before_tool_call, Hermes pre_tool_call |
| Agents built with a framework | Middleware or a per-tool approval setting | LangChain HumanInTheLoopMiddleware, LangGraph interrupt(), OpenAI Agents SDK needsApproval |
| MCP tools | A proxy or gateway between the MCP client and server | MCP gateways, local stdio proxies |
| Workflow platforms | A review step in the workflow | n8n human review for AI tool calls |
Sending the call for approval
When approval happens outside the agent, the hook or proxy sends the pending call to an approval service. The Agent Approval Protocol is an open standard for that request. The hook sends it to POST /api/aap/v1/requests with an Idempotency-Key header:
{
"tool": "issue_refund",
"server": "stripe",
"arguments": { "amount": 4900, "reason": "duplicate_charge" },
"agent_reasoning": "Refunding the duplicate charge for [email protected].",
"timeout": "30m"
}
The request starts as pending and ends in exactly one terminal state: approved, denied, expired or cancelled. Only approved lets the call run.
What a production HITL system needs
- Enforcement at the tool-call layer. An instruction like "ask before deleting data" in a prompt is something the model can forget. Holding the call outside the model makes approval mandatory.
- Fail closed. If the approval service is unreachable or nobody decides before the deadline, the call doesn't run. A timeout counts as a denial.
- Asynchronous waits. Decisions take seconds to days. The adapter creates the request, then polls, long-polls or receives a webhook. Nothing holds a connection open.
- Idempotency. Agents retry. Retrying with the same idempotency key returns the same request and decision instead of adding a duplicate to the review queue.
- Exact arguments. Reviewers approve what will run, not the agent's description of it. The agent's reasoning is shown separately, as an unverified claim.
- Single-use approvals. One approval runs one call, within a short window. Running the same call again needs a new approval.
- Selective review. Sending every call to a person causes approval fatigue: reviewers start approving without reading. Rules should send only consequential calls to people.
- Audit trail. Each decision records who decided, when and through which channel.
Human-in-the-loop vs. human-on-the-loop vs. human-out-of-the-loop
- Human-in-the-loop (HITL): a person approves each action before it runs.
- Human-on-the-loop (HOTL): the system acts on its own, and a person monitors it and can step in to stop it.
- Human-out-of-the-loop: the system acts on its own, with no person involved while it runs. Fully autonomous AI agents work this way.
| Model | The human's role | When the action runs | AI agent example |
|---|---|---|---|
| Human-in-the-loop | Approves each action | Only after approval | Issuing a refund over $500 |
| Human-on-the-loop | Monitors and can step in | Right away, unless someone stops it | Answering support tickets while a person watches and can pause the agent |
| Human-out-of-the-loop | None while the system runs | Right away | Reading files or running tests |
Most agent deployments mix the three. Routine calls run without review, and consequential calls wait for approval.
FAQ
What does HITL stand for?
HITL stands for human-in-the-loop: a person must approve, reject or correct an AI system's work before it takes effect.
Is human-in-the-loop part of agentic AI?
Yes. Agentic AI plans and acts on its own, and human-in-the-loop is how you keep a person in control of the actions that are risky or hard to undo.
Can AI agents be fully autonomous?
Yes, for calls that are low-risk and easy to undo, such as reading files or running tests. Calls that are hard to undo, such as refunds, deletes or deploys, should wait for approval. Most teams let agents run on their own and send only consequential calls to a person.
Does the EU AI Act require human-in-the-loop?
Article 14 of the EU AI Act requires high-risk AI systems to be designed so people can oversee them effectively, including overriding or stopping them. It doesn't require approval of every action, but human-in-the-loop approval is one way to provide that oversight.
How do I add human-in-the-loop to an AI agent?
Agent frameworks such as LangGraph and the OpenAI Agents SDK can pause a run before a tool call. An approval layer such as withHuman adds the rules, reviewers, notifications and audit trail, across every agent you run. For a side-by-side look, see the best human-in-the-loop tools for AI agents.