Human in the loop is a named person, a ceiling, and a fail line. Teams paste the letters onto a workflow diagram and call the last box Review. That box is where the send already happened.
This page is the wiring. If you needed the definition, use the meaning article. If you are about to give an agent a tool that can leave the building, stay here.
Four objects, then the gate
LLM integration is operating design names four seats: model, prompt, tools, review. HITL is the review seat filled with a person who can fail the work. Filling it in an AI workflow takes four written objects.
Charter. What the agent is for, what good looks like, what it must hand back. Without a charter the reviewer is marking a mood.
Override doctrine. The refuse-list: spend above a ceiling, speak as the company, change production data, close a judgment you still own. The reviewer enforces the list. The list is not the reviewer.
Named reviewer. One person on duty, not a function, not #human-review. Write the fail line in a sentence the person can use at 23:00. “Looks fine” is not a fail line.
Log. Who called which tool, the arguments or a safe summary, the reviewer decision, result class, timestamp, and correlation ID. If you cannot reconstruct Tuesday, you cannot review.
MCP is how the tool is allowed to touch the building. HITL is who may let it. Do not confuse the contract with the person. MCP explained for founders is the permission page. This page is the gate.
Put the person on the irreversible step
A workflow has many steps. HITL does not belong on all of them. It belongs on the step you cannot undo cheaply.
Default gates:
- Send. Mail, Slack to a customer, a public post, a ticket the other party will read as the company.
- Spend. A refund, a vendor payment, a cloud quota that invoices.
- Delete. Production data, a repo, a customer record.
- Speak as the company. Anything that will be quoted as you.
Drafting, summarising, ranking, and fetching can run without a human in the loop if the output cannot leave. The moment a tool can send, the named person sits on that call. A weekly steering committee after the mail went out is incident review, not HITL.
Walk one send
An agent watches contracts and drafts a renewal reminder for an account whose term ends in ten days. Drafting is not HITL. Nothing has left. The same agent then calls send_email. That call is the gate, and the gate is only real if the screen carries five things.
- The payload as it will ship. Final subject, final body, final attachments. Not a summary of the mail. Not “renewal reminder to Acme.” A summary is a different artefact from the thing that leaves.
- The target. Recipient address, the from-address, the thread it lands in. Read this line first. The right text at the wrong address is still a failed send.
- The reversal cost. One sentence, written in advance: “Once the receiving server accepts this, it cannot be recalled.” Without that cost, the reviewer cannot price the approval.
- Why the agent wants to send. The clause, record, or ticket the draft is built on. If the agent cannot name the source, that alone is a fail line.
- A deny that stops the call. Not a comment. Not a reaction emoji. A button that returns an error to the tool and writes the refusal to the log.
If read and write share one unbounded credential, you lost the ceiling before the screen exists. Separate their permissions. If they stay on one server, give the write its own scoped credential and allowlist: recipients already on the account, spend under a named cap, deletes never. Then put the name on the write.
The gate is not free, so make it small
The first objection is speed. It is a fair objection and it has a wiring answer.
Watch queue depth and age. If reviewers approve by pattern because they cannot read each payload, the tool is too broad. Narrow it: fewer recipients on the allowlist, a spend cap that removes routine cases from the queue, a dry-run mode for anything that only needs to be seen once.
Give the queue a clock. If the named person has not acted within the written window, the call expires and the agent has to ask again. A stale approval must not execute merely because the tab stayed open.
Batch what is genuinely alike. Twelve renewal reminders to twelve known accounts can be one screen with twelve payloads and twelve deny buttons. One refund to a customer who threatened to leave is its own screen. Batching is a formatting choice. It is not permission to approve a class you did not read.
Calibrate the first ten writes; keep permanent gates
For a new write tool, inspect the first ten attempted writes end to end: request, payload, approval or denial, execution result, and log entry. Ten is a startup checklist, not proof that the tool is safe.
After that, ask for Tuesday. If nobody can show every send between 09:00 and 18:00, keep the tool read-only. Logs may replace live approval only for lower-risk calls that the override doctrine already permits.
Permanent gates do not graduate: money above the cap, anything a customer will read as the company, anything that deletes. Those keep the person. Lower-risk calls can move to sampled log review with a written rate, owner, and review date.
The offline rule still binds. If the send ships while the named person is on a plane, you decided the loop was optional. Write what happens when they are unreachable: queue, refuse, or escalate to a named deputy. “Ship anyway” is a decision. Record it as one.
What this is not
It is not a dashboard. Grafana after the fact does not fail the call.
It is not eval theatre. Scoring fluency of the paragraph is a different page. HITL scores whether the irreversible step was allowed.
It is not a committee. Five people with a Slack emoji are not a ceiling.
It is not the book. The Human-in-the-Loop Life is the personal side of the same question. It is an early draft. It is not for sale. You can still name the person on the send.
A card per write tool
The meaning page carries the card for the person: name, ceiling, fail line, offline rule. This is the card for the tool. One per thing that can write. Pin it next to the server config.
Tool. The exact call, not the workflow. send_email, not “outreach.”
Gate. Send, spend, delete, or speak.
Payload shown. What the reviewer sees before they decide. If this line says “a summary,” fix it before you ship.
Allowlist and cap. Which targets, which ceiling. Blank means unbounded.
Expiry. How long an unanswered request lives, and what happens then.
Log. Where Tuesday lives. If this line is blank, the tool stays read-only.
Six lines. If you cannot fill them, you are not ready to apply HITL to this tool. Remove the write. The letters on the architecture slide can wait.