Keeping a human in the loop

Guardrails keep a loop from running forever or wandering. But there is a second kind of safety that matters just as much: making sure the agent does not do something irreversible without a human saying yes first. This is the human-in-the-loop, and for anything consequential it is non-negotiable.

Why it matters more once an agent can act. A looping agent that only reads and drafts is low-risk — the worst case is a bad draft you throw away. But the moment the loop can take real actions in the world — send an email, spend money, delete a file, post publicly, change a setting — the stakes jump. A wrong answer is an annoyance; a wrong action taken automatically can do real damage, and a loop can take that action fast, many times, before you notice.

The pattern: the agent proposes, you approve. The safe design is simple. Let the loop do all the thinking and preparation — research, draft, plan, calculate — but insert a human checkpoint before any consequential action. The agent drafts the email and waits; you approve before it sends. The agent proposes the deletion; you confirm before it happens. You keep almost all of the time savings and remove almost all of the risk.

Which actions need a checkpoint. A useful rule: require approval for anything that is hard to undo or affects the outside world. Sending messages, making payments or purchases, deleting or overwriting data, publishing or posting, and changing account or system settings all belong behind a human yes. Reading, searching, summarizing, and drafting generally do not — those are safe to let the loop do freely.

Give the loop the fewest powers it needs. Related principle: do not hand an agent abilities it does not need for its task. A research agent needs to read and search, not to send or delete. Narrow powers plus approval on the risky few actions is the combination that makes a looping agent both useful and safe.

Recap. Guardrails stop a loop from running away; the human-in-the-loop stops it from doing irreversible harm. Once a loop can act in the world, a wrong action taken automatically is far more damaging than a wrong answer — so the safe pattern is the agent proposes and prepares, and a human approves before anything consequential (sending, paying, deleting, publishing, changing settings). Let the loop read, search, and draft freely, put approval on the risky few actions, and give the agent the fewest powers it needs. That combination keeps looping both useful and safe.