“Human in the loop” is not a moral sticker. It is a control-plane decision: which steps may fire without a person, and which may not.
Bye Prompt’s bias: automate the reversible; gate the rest. If you cannot undo it in five minutes, a human should click.
A simple permission ladder
| Level | Agent may | Human must |
|---|---|---|
| Read | Fetch, summarize, propose | Nothing yet |
| Draft | Write files in a branch / folder named draft | Merge, send, publish |
| Act in sandbox | Run tests, local commands, staging | Production |
| Spend / send / delete | Prepare the action | Confirm |
Most teams skip from chat to “act in production” because the demo did. Draw the ladder on a wiki page. Then encode it in the spec as stop conditions.
Always-human (default list)
Put a person on:
- Money movement — anything that spends, refunds, or changes payout rails (Pay By Prompt)
- Purchases above a threshold you actually mean (Buy By Prompt)
- Public publish — posts, emails to customers, app listings
- Identity — access grants, DNS, production secrets
- Irreversible delete
- Legal / medical / safety advice presented as more than a draft
- Anything you could not explain to a regulator with a straight face
You can raise automation later. Starting unsupervised is how you learn the expensive lesson first.
Humans are bad loops, too
People rubber-stamp. If your “review” is a green button next to 400 lines, you do not have a loop. You have theater.
Make review cheap:
- Small diffs
- Checklists, not essays
- Highlight must-not violations
- Time-box: if review takes longer than doing the job, the agent is in the wrong mode
Evaluation is how review stays cheap.
Pairing humans with traces
When an agent used tools, the human should see:
- Plan that was approved
- Tools called (and arguments, redacted)
- Files touched
- Why it thinks tests passed
A chat bubble that says “All done!” is not a trace. If the product cannot show a trace, keep it at draft level.
Escalation language (paste into specs)
If you are blocked, unsure, or about to take an action not in the plan, stop. Write: (1) what you wanted to do, (2) why it is not in the spec, (3) what you need from a human. Do not improvise on money, publish, or delete.
Agents that “helpfully” continue are the ones that close the wrong ticket.
Culture
A team that punishes people for stopping an agent will get fewer stops and more incidents. Reward good halts. That is the whole safety program for a five-person shop.