Human-in-the-Loop
AI Agents.

Why Agents Need Human Oversight

The failure mode that keeps AI safety researchers awake at night is not the dramatic science-fiction scenario — it is the mundane one. A production agent given broad permissions and a high-level objective will, on a long enough timeline, encounter an ambiguous situation where its best interpretation of the task leads to a catastrophically bad outcome.

Consider a real scenario that multiple organizations have experienced in 2025-2026: an email agent tasked with “clearing the backlog” sends 10,000 automated messages to customers without any human review because no one explicitly told it that “backlog” meant the internal support queue rather than the entire unread inbox. There was no malice, no prompt injection, no security failure — just an LLM interpreting an instruction differently than the human intended, with no checkpoint to catch the divergence before execution.

The categories of failure are consistent across incidents: irreversibility (deleted records, sent emails, executed payments cannot be undone), scale amplification (an agent can make 10,000 API calls before a human notices, where a human would have noticed after 3), and context loss(the agent's understanding of the task may drift from human intent over a long-running session). HITL controls are the circuit breaker for all three.

The goal is not to require human approval for everything — that defeats the purpose of autonomous agents. The goal is to identify the specific action categories where the cost of an error is high enough that human judgment is worth the latency, and enforce approval exactly there. Everything else runs at full autonomous speed.

When to Require Approval

The four categories below represent the near-universal consensus across security frameworks, EU AI Act guidance, and real-world incident analysis. Any agent action that falls into one of these categories should have a REQUIRE_APPROVAL policy as the safe default.

The Approval Workflow

When an agent attempts a tool call covered by a REQUIRE_APPROVAL policy, SupraWall pauses execution, creates an approval request, routes it to the configured reviewer channel, and holds the agent in a suspended state until a decision is made. The agent receives either a resumption signal (approved) or a deny response that it can handle in its error logic.

import suprawall

sw = suprawall.Client(api_key="sw_live_...")

# Define HITL policies by action category
policies = [
    # All Stripe charges require approval
    {
        "agent_id": "billing-agent",
        "tool": "stripe.charge",
        "action": "REQUIRE_APPROVAL",
        "approver_channel": "slack",
        "approver_slack": "#billing-approvals",
        "ttl_seconds": 900,  # 15 minutes or auto-deny
        "context_fields": ["amount", "customer_id", "description"],
    },
    # Bulk email requires approval; single replies are allowed
    {
        "agent_id": "support-agent",
        "tool": "email.send_bulk",
        "action": "REQUIRE_APPROVAL",
        "approver_channel": "email",
        "approver_email": "comms-review@company.com",
        "ttl_seconds": 3600,  # 1 hour
        "context_fields": ["recipient_count", "subject", "preview"],
    },
    # Infrastructure mutations require approval from infra team
    {
        "agent_id": "infra-agent",
        "tool": "aws.*",
        "condition": "action_type in ['create', 'delete', 'modify']",
        "action": "REQUIRE_APPROVAL",
        "approver_channel": "dashboard",
        "approver_group": "infra-team",
        "ttl_seconds": 1800,
    },
]

sw.apply_policies(policies)

from suprawall.exceptions import ApprovalRequired, ApprovalDenied, ApprovalExpired

try:
    # This triggers the REQUIRE_APPROVAL policy
    result = await agent.execute("charge customer $2,400 for annual plan renewal")

except ApprovalRequired as e:
    # Approval request has been sent — agent is suspended
    print(f"Approval pending: {e.request_id}")
    print(f"Routed to: {e.channel} ({e.approver})")
    print(f"Expires in: {e.ttl_seconds}s")
    # Agent state is preserved — execution resumes automatically if approved

except ApprovalDenied as e:
    # Human reviewer denied the action
    print(f"Action denied by {e.reviewer}: {e.reason}")
    # Handle gracefully — log, escalate, or inform user

except ApprovalExpired as e:
    # TTL expired before reviewer responded — auto-denied
    print(f"Approval request expired after {e.ttl_seconds}s")
    # Safe default: treat as denial

Approval Channels

Where approvals are routed determines whether HITL controls actually work in practice. A system that emails approvals to an inbox that reviewers check weekly is not a real oversight mechanism. SupraWall supports three channels, each designed for different organizational workflows and response time requirements.

EU AI Act Article 14: Human Oversight

Approval Expiry and Auto-Deny

One of the most commonly overlooked aspects of HITL design is approval TTL. An approval system without expiry has a critical failure mode: a reviewer approves an action hours or days after it was requested, by which point the agent's context has changed, the business conditions have changed, or the action is no longer appropriate — but it executes anyway because the approval is technically valid.

SupraWall enforces TTLs at the policy level. When a TTL expires before a decision is made, the request is automatically denied and the agent receives an ApprovalExpired exception. The safe default is always denial — an agent waiting indefinitely for approval should not be allowed to proceed just because no one got to the queue.

TTL recommendations by action category:

Implementing HITL in 4 Steps

Frequently Asked Questions

Related Resources