Human-in-the-Loop Engineering

Confidence Routing: deciding when it's worth interrupting a human

Background & principle

Day 31 sorted by reversibility (reversible runs free, irreversible gets a gate). Add a second axis here: confidence × impact. The cross yields three tiers — auto (high confidence + low impact, run free), ask (low confidence or medium-high impact, ask a human), deny (over-budget / unauthorized, just refuse — it never enters the human queue). The key trap: confidence can't be self-reported by the model — it systematically overestimates. Use verifiable proxy signals instead: retrieval hit count, whether a tool errored, self-consistency across samples, whether output matches the schema. "I'm confident" doesn't count; the evidence does.

In practice

def confidence(ctx):                  # verifiable signals, not "how sure are you?"
    sigs = [ctx.retrieval_hits >= 2,
            not ctx.tool_errored,
            ctx.self_consistency >= 0.8,    # agreement across samples
            ctx.schema_ok]
    return sum(sigs) / len(sigs)

def route(action, ctx):
    if action.over_budget or action.unauthorized:
        return "deny"                     # unauthorized isn't "ask" — it's a bug
    c, impact = confidence(ctx), action.impact
    if c >= 0.8 and impact == "low":  return "auto"
    return "ask"                          # low confidence or high impact → ask

Core mental model: HITL's cost is human attention, and attention is a scarce, depletable resource. Routing's goal isn't "safer" — it's "spend each human intervention where it counts."

Async Approval: let the agent pause, notify, and resume

Background & principle

When the agent hits the ask tier, input() freezes the whole worker, idling on a terminal that may have nobody at it for hours. The fix follows durable execution: checkpoint state outside the process (not in memory) → send a request to an approval channel (Slack / phone push / queue) → yield resources and exit → once the human decides, resume from the checkpoint via callback or polling. Two iron rules: state must live outside the process (a crash mustn't lose the approval); resume must be idempotent (replaying the same approval can't execute the action twice). Attach an SLA timeout to each approval: hung too long → default-deny or escalate, never wait forever.

In practice

async def step(ctx):
    action = plan(ctx)
    if route(action, ctx) == "ask":
        aid = save_checkpoint(ctx)              # ① state out of process, with approval_id
        notify("slack", action, aid)         # ② fire request, don't await
        raise Suspend(aid)                      # ③ yield worker, exit
    return execute(action)

def on_approval(aid, decision):               # triggered by callback after the human acts
    if seen(aid): return                     # ⑤ idempotent: replays don't re-execute
    mark_seen(aid); ctx = load_checkpoint(aid)
    if decision == "approve": resume_from(ctx)  # ⑥ continue from checkpoint
    else: resume_from(ctx, denied=True)        # feed denial back to the agent too

Interruptible & Takeover: not just "approve / reject," but "edit"

Background & principle

Thinking of human intervention as only approve / reject wastes it. Real workflows have two more valuable moves: edit (fix its plan / draft / params and continue) and takeover (a human does a few steps, then hands back). To support both, the agent loop needs three things: interruptible (not a while True running to the death), serializable state, and resumable from any checkpoint. The commonly-missed part: after a human edits, you must feed the change back into the agent's context — otherwise its next step overwrites your edit with the old plan. So "plan" and "draft" must be explicit, human-overwritable state, not buried in prompt history.

In practice

def loop(state):
    while not state.done:
        if stop_requested(): return snapshot(state)  # interruptible: save & exit anytime
        proposal = plan(state)
        decision = await_human(proposal)        # approve / edit / takeover
        if   decision.kind == "approve":  state = execute(proposal, state)
        elif decision.kind == "edit":
            state.plan = decision.edited         # human-edited plan
            state.ctx += f"[human edited plan: {decision.note}]"  # feed back! or it's overwritten
        elif decision.kind == "takeover":
            state = decision.human_steps         # human does steps, then resume
    return state

A counterintuitive but important point: edit is cheaper than reject. Reject sends the agent back to square one (it may repeat the same mistake); edit nudges it straight onto the right track — one correction beats ten rejections.

Approval Observability & Audit: who approved what, and was it right

Background & principle

Each approval should record at least: the action, the agent's reason, the confidence, who approved, how long it took, the outcome. This log has two uses. First, retune routing thresholds — an ask class you approve 95% of the time → demote to auto; an auto class that caused an incident → promote to ask. The §1 thresholds aren't set once; they grow out of audit data. Second, escalation & delegation — high-impact actions require more than one approver / a specific role (lightweight RBAC); an approval hung too long auto-escalates to a backup. Finally, the single best move against approval fatigue: batch similar low-risk actions (approve 10 on one screen) rather than popping 10 dialogs.

In practice

def log_approval(rec):                    # every approval to the store: retune + accountability
    db.insert(action=rec.action, reason=rec.agent_reason,
              conf=rec.confidence, approver=rec.who,
              latency=rec.decided_at - rec.asked_at, outcome=rec.result)

def retune(action_type):                  # regress thresholds from history
    rows = db.query(action_type, last_days=14)
    rate = mean(r.outcome == "approved" for r in rows)
    if rate > 0.95 and no_incidents(rows): suggest("ask→auto")  # always approved = redundant ask
    if any(r.outcome == "incident" for r in rows): suggest("auto→ask")