An agent that can act autonomously will eventually try to do something you'd want to stop — spend money, delete a record, email a customer, force-push to main. A human-in-the-loop (HITL) gate makes consequential actions require approval without turning the whole agent into a manual tool. This skill adds that gate cleanly.
When to use this skill
- An agent performs irreversible or costly actions (payments, deletions, deploys, outbound messages, merges).
- You're moving an agent from a trusted sandbox toward production or real-user traffic.
- A compliance or safety requirement mandates a human checkpoint before certain operations.
Instructions
- Classify actions by consequence. Separate reversible/cheap actions (read a file, search) the agent may do freely from consequential ones (write to prod, spend, send, delete) that require approval. Gate only the latter — gating everything destroys the point of an agent.
- Interrupt before the action, not after. At the gate, pause the agent and surface the proposed action plus its context: exactly what it will do, the arguments, and why. The human approves, edits, or rejects.
- Make the pause durable. Persist agent state at the interrupt (checkpoint) so approval can come seconds or hours later, and a process restart doesn't lose the run. Frameworks like LangGraph provide interrupt/resume primitives; for others, persist state explicitly.
- Handle all three outcomes. Approve → resume from the checkpoint. Edit → resume with the modified action. Reject → abort safely (no partial side effects) and record the reason.
- Fail safe and audit. Default to not acting on timeout or ambiguity, and log every gated decision (action, context, who approved, outcome) for accountability.
- Right-size the friction. Too many prompts and humans rubber-stamp; too few and risky actions slip through. Gate by genuine blast radius, and consider thresholds (e.g. approve refunds over $X).
[!WARNING]
A gate that fires on everything trains humans to approve blindly — which is worse than no gate, because it looks safe. Gate only genuinely consequential actions, and show enough context to make a real decision.
[!NOTE]
The gate must be enforced where the action executes (the tool layer), not just requested in the prompt. A prompt instruction to "ask first" is a suggestion; a code-level interrupt is a guarantee.
Output
A working approval gate: the action-consequence classification, the interrupt/resume implementation with durable state, the approve/edit/reject handling, fail-safe defaults, and an audit log of decisions.
1---2name: human-in-the-loop-gate3description: Add a human approval checkpoint to an agent so it pauses before a risky or irreversible action (spending money, deleting data, sending messages, merging code) and resumes only after a human approves. Use when an agent acts autonomously on consequential operations.4---56An agent that can act autonomously will eventually try to do something you'd want to stop — spend money, delete a record, email a customer, force-push to main. A human-in-the-loop (HITL) gate makes consequential actions **require approval** without turning the whole agent into a manual tool. This skill adds that gate cleanly.78## When to use this skill910- An agent performs irreversible or costly actions (payments, deletions, deploys, outbound messages, merges).11- You're moving an agent from a trusted sandbox toward production or real-user traffic.12- A compliance or safety requirement mandates a human checkpoint before certain operations.1314## Instructions15161. **Classify actions by consequence.** Separate reversible/cheap actions (read a file, search) the agent may do freely from consequential ones (write to prod, spend, send, delete) that require approval. Gate only the latter — gating everything destroys the point of an agent.172. **Interrupt before the action, not after.** At the gate, pause the agent and surface the **proposed action plus its context**: exactly what it will do, the arguments, and why. The human approves, edits, or rejects.183. **Make the pause durable.** Persist agent state at the interrupt (checkpoint) so approval can come seconds or hours later, and a process restart doesn't lose the run. Frameworks like [LangGraph](/tools/langgraph) provide interrupt/resume primitives; for others, persist state explicitly.194. **Handle all three outcomes.** Approve → resume from the checkpoint. Edit → resume with the modified action. Reject → abort safely (no partial side effects) and record the reason.205. **Fail safe and audit.** Default to *not acting* on timeout or ambiguity, and log every gated decision (action, context, who approved, outcome) for accountability.216. **Right-size the friction.** Too many prompts and humans rubber-stamp; too few and risky actions slip through. Gate by genuine blast radius, and consider thresholds (e.g. approve refunds over $X).2223> [!WARNING]24> A gate that fires on everything trains humans to approve blindly — which is worse than no gate, because it looks safe. Gate only genuinely consequential actions, and show enough context to make a real decision.2526> [!NOTE]27> The gate must be enforced where the action executes (the tool layer), not just requested in the prompt. A prompt instruction to "ask first" is a suggestion; a code-level interrupt is a guarantee.2829## Output3031A working approval gate: the action-consequence classification, the interrupt/resume implementation with durable state, the approve/edit/reject handling, fail-safe defaults, and an audit log of decisions.
imtiazrayhan