Human-in-the-loop: staying in control of an AI agent

An AI agent that acts on its own is fast. An agent that asks you about everything is useless. In between there is a simple idea: it stops at the right moments, and you make the call.

What “human-in-the-loop” means

For an AI agent, human-in-the-loop is an operating rule: at certain points, the agent doesn't decide. It shows what it is about to do, it waits, and it only goes on once a person has said yes.

This isn't about distrusting the model. An agent can reason perfectly well and still get it wrong: it misread an amount, picked the wrong recipient, or took “remove the duplicates” more broadly than you meant. As long as it is writing a draft, a mistake costs nothing. The moment it pays, sends or deletes, it does.

Three ways to do it

• Approve everything. The agent asks before every action. It's safe, but you end up clicking “yes” without reading, which is the same as approving nothing.
• Approve nothing. The agent acts alone and you review afterwards. That works for anything you can undo: a file you can restore, a draft, a search.
• Approve what can't be undone. The agent works alone most of the time, and stops before the moves that commit you: paying, sending, deleting, publishing, signing up, choosing for you. This is the approach that holds up over time.

The third one means telling the agent where the line is. One sentence in its instructions is often enough: “Before paying, sending a message on my behalf or deleting anything, ask me. If I don't answer, don't do it.” The guide What an AI agent shouldn't do on its own goes through that list in detail.

What a good approval request contains

If the question is vague, you'll either answer at random or go check for yourself, and the agent will have been no help. A useful request comes down to a few things:

• a short question you can read in a second: “Pay the OVH invoice of €42.90?”;
• the context you need to decide without opening anything else: the amount, the recipient, the text of the email, the command line;
• ready-made answers, as buttons: “Pay”, “Wait”, “Refuse”;
• a deadline: after a while, the question expires and the agent doesn't act.

That last point matters more than it seems. Silence must never count as approval. If nobody answers, the action doesn't happen.

Where the question should reach you

Agents often work while you're away from the screen: a long task in Claude Code, an n8n workflow running overnight, an assistant sorting your email. If the request stays in the terminal, the agent waits for hours for nothing. The question has to come to you, on your phone, where you already read your messages, with a way to answer without opening an app.

How to set it up

There are two main ways:

• Build it yourself. Frameworks like LangGraph can pause an agent and resume it later. n8n has nodes that send a message and wait for the reply. That's the right choice if you already write your agent in code and want to keep everything in-house.
• Give the agent a tool. With the MCP protocol, you plug a tool such as ask_human into the agent, and it calls it when it needs you. No code: you paste a URL into Claude, ChatGPT or Cursor.

That's what Aval does: your agent asks you on your phone, on Telegram or by email, with one button per answer, and waits. The guide Adding human approval to an MCP agent shows how to connect it.

Frequently asked questions