Designing Human-in-the-Loop AI Actions

When we let agents take real actions, we made one rule non-negotiable: anything that writes to an external system requires explicit human approval first — implemented as a two-turn write-confirm pattern that pauses the agent, surfaces exactly what it wants to do, and waits for a person to allow it. Convenience never overrides that gate.

Why reading is safe and writing is not

There is a sharp line between an agent reading and an agent writing. A read — looking up an order, searching docs, fetching a status — has bounded consequences; the worst case is a wrong answer, which grounding and citations already guard against. A write — filing an issue, issuing a refund, creating a record, sending a message — changes the world, and a wrong one can cost money, leak data, or spam a customer. Treating those two the same is how automated systems cause real damage. So we automate reads freely and gate every write behind a human.

The two-turn write-confirm pattern

The key design decision is that the pause happens before execution, not after. The agent never performs a write and asks forgiveness; it proposes, waits, and acts only on a yes. The confirmation is specific — the actual action and target, not a vague "the agent wants to do something" — so the human is approving a concrete operation they can understand and judge. This makes the human a real checkpoint rather than a rubber stamp.

Making approval meaningful, not annoying

A gate that fires on everything trains users to click through it blindly, which defeats the purpose. So the gate is scoped to writes only — reads flow without friction — and the confirmation carries enough detail to make a genuine decision quick. The goal is that when an approval prompt appears, it means something, because it is rare and specific. That balance keeps the human engaged on the decisions that matter instead of numbed by a constant stream of trivial confirmations.

Why this is a feature, not a limitation

It is tempting to see the approval step as the agent being less capable. We see it as the opposite: it is what makes an action-taking agent trustworthy enough to deploy at all. A business will not connect an agent to its issue tracker, its billing, or its customer records if the agent can write to them unsupervised. The confirmation gate is precisely what makes those connections safe to grant — it is the thing that lets the agent be powerful, because power without a checkpoint is a liability no one sane will accept. Designed well, human-in-the-loop is not a brake on agents; it is the seatbelt that lets you drive fast.

Getting started

See the write-confirm pattern in action on the AIML.chat free plan: connect a tool and watch the agent pause for approval before any write. Read AI agent safety and write-confirm, what is an AI agent, and compare tiers on the pricing page.