What is Human in the Loop?
Also called HITL, human oversight, approval step.
Human in the loop describes an agent design in which a person reviews, approves, corrects, or supplies input at defined points before the system proceeds. It is typically applied to actions that are costly or hard to reverse, such as sending external messages, changing records, or spending money. The pause is enforced by the runtime, not requested by the model.
The pattern takes several forms. Approval gates stop before a specific action and wait for a yes. Review of drafts lets a person edit output before it is used. Input requests ask a person for information the agent cannot obtain. Escalation transfers the whole task when the agent hits a boundary. Each interrupts at a different point and carries different latency.
Placement is the design work. Gating everything makes the system slower than doing the task directly and produces rubber stamping, where reviewers approve without reading. Gating nothing exposes irreversible mistakes. The usual rule is to gate by reversibility and blast radius: an action affecting one record and easily undone can proceed, while anything external or permanent stops.
Implementation requires durable state, because the pause can last hours. The run must be checkpointed, the pending decision surfaced somewhere a person will actually see it, and the resume path must continue from exactly where it stopped without repeating completed side effects. Timeouts also need a defined default, and the safe default is to do nothing rather than proceed.
Meaningful oversight is also a regulatory expectation in several jurisdictions for decisions with legal or similarly significant effects, so gates are sometimes a compliance requirement rather than a design preference. The concept is closely tied to autonomy level, which describes how much runs unattended, and to handoff, which is the transfer that escalation performs.
Key points
- A person approves, edits, or supplies input at defined points.
- Gate by reversibility and blast radius, not on everything.
- Pauses need durable state and a safe timeout default.
- Over-gating causes rubber stamping and defeats the purpose.
In practice
An outreach agent drafts twenty follow-up emails overnight. Drafting, research, and personalization all happen unattended, because none of it leaves the system. Every message then waits in a review queue. In the morning a person reads them, edits three, deletes one, and approves the rest, at which point the agent resumes and sends only the approved messages.