Autonomous agents are astonishing right up to the moment one of them wires the wrong amount, drops the wrong table, or emails the wrong list. The failure mode of agents isn't that they're dumb — it's that they act, confidently, on irreversible things.
The direct answer
A human-in-the-loop (HITL) gate pauses a risky agent action until a person approves or rejects it. Done well, it is fail-closed — if the request is unknown, malformed, or times out, the action simply does not run — and it leaves a tamper-evident audit trail of who decided what.
Why not just prompt the model to be careful?
Because "be careful" is not an enforcement boundary. A prompt is advisory; a gate is a control. The action either reaches a human decision point or it doesn't, and that decision is recorded outside the model's control.
The invariants that actually matter
- Fail closed. Uncertainty resolves to the safe verdict. The permissive path is never the default.
- Atomic state and audit. The verdict and its audit record commit in one transaction — you can never have one without the other.
- Append-only history. The log is hash-chained and has no edit path, so the record of decisions is verifiable.
Where the gate goes
Only around the actions you can't undo — moving money, deleting data, granting access, contacting customers. Everything else runs at full speed. That's approval by exception: fast by default, guarded where it counts.
Wrap the call, let a human decide, enforce the verdict. That's the whole idea — and it's one SDK call away.