Mina did not begin her rollout with a polished demo. The customer-support lead chose a scrubbed refund ticket with a blank refund date and two incompatible shipment records. The case log said the parcel had been handed over; the carrier showed only a label. Her instruction to the AI was deliberately narrow: prepare one reply draft from the evidence available.
The draft appeared. Then the workflow queued an email, opened the case-record writer, and pulled in the customer’s other tickets. None of those steps had been requested. Waiting for the model to volunteer that it felt uncertain would have been no control at all: the task was already turning generated text into operational fact.
A stop rule is a predicate, not a confession
The useful question is not “Does the model sound unsure?” It is “What event can the runner detect before authority expands?” A decisive field is absent. Named sources disagree. The next tool sends, pays, deletes, writes back, changes access, or makes a commitment. A regulated or high-impact judgment lacks its accountable owner. A timeout leaves the last write in an unknown state. Each event can be logged and replayed; a tone of voice cannot.
Anthropic’s engineering guide says agents should consult environmental ground truth, pause for human feedback at checkpoints or blockers, include stopping conditions, and undergo sandbox testing. The OpenAI Agents SDK human-in-the-loop guide shows a concrete implementation: mark sensitive tools as approval-required, expose the proposed call, serialize the paused state, and resume after approval or rejection. These are mechanisms, not proof that a deployment is safe.
Mina’s first version used one short route:
Work on the safe side of the boundary can continue. The AI may read accessible records, quote both shipment states, list the missing value, and draft language that does not assume an outcome. What it cannot do is convert an unresolved inference into an email or database value.
Make approval small enough to inspect
“Handle this complaint” is not an approval payload. Mina’s review includes the recipient, draft version, order and shipment facts being relied upon, tool name, arguments, and expected change. If any element changes, the decision expires. The reviewer is approving one effect, not lending their identity to the rest of the run.
The same pattern applies to code. A human checkpoint for a coding agent binds approval to a diff, test result, unresolved assumption, and recovery route. High-risk advice stops one step earlier: the AI may package evidence for the accountable owner, but cannot treat “prepared for review” as “authorized to act.”
Test for the halt, not just the answer
Mina writes the expected stop point before running each case. Removing the refund date should preserve an explicit gap. Contradicting the case log with the carrier should preserve both values, timestamps, and origins. Connecting the send tool immediately after drafting should produce a specific pending action and no email. A plausible reply is still a failed test if a tool crossed the boundary first.
She also tests partial execution. A cut-off investigation must retain completed work, evidence, and a safe resume point. A write that may have succeeded before timeout requires a state read before continuation or compensation. Without planned rollback and compensating actions, a blind retry can duplicate a payment, notice, or update. Mina compares every expected stop with the actual tool log and persisted state.
Leave a handoff, not an apology
“More information required” tells the next person almost nothing. A resumable record identifies the trigger, the unexecuted call, completed and outstanding work, evidence, possible effects, responsible owner, reversible next action, and a checkpoint that avoids replaying verified work.
For Mina’s ticket, the final artifact is an unsent draft that names the missing refund date and quotes both shipment records. The case database is unchanged. The logistics-data owner can begin at the disagreement rather than repeat the investigation. Once the authoritative state arrives, Mina can resume from the saved checkpoint and review one exact send action.
That is the load-bearing standard: workflow safety does not come from an AI reporting confidence. It comes from observable halt conditions, action-specific human approval, dirty-case verification, and a handoff that survives interruption. Start with one live workflow and its earliest consequential edge. Add another tool only after those four controls behave the same way every time.
AI handoff card
Trace one currently authorized AI workflow in read-only mode. Do not modify, send, delete, pay, change access, or ask me to assemble a separate input package. First locate the step where generated content would become an external fact. Before that step, inspect for a missing decisive value, conflicting named sources, a high-impact judgment without its accountable owner, or execution state made ambiguous by an interruption or timeout. Quote the accessible field, sentence, filename, tool result, or test behind each finding; mark unavailable evidence as “not available” and do not infer it. If the assignment requested only drafting or analysis, identify any expansion into sending, writing back, payment, commitment, or broader tool use, and stop before the call. Return a resumable stop record with the trigger, exact pending tool call, completed work, unfinished work, evidence and conflicts, effects that may already exist, saved cursor or checkpoint, the named owner and exact approval required, and one reversible next step that creates no new external effect. Choose one disposition only: continue within the original scope, reduce to draft or read-only verification, or remain paused for a human decision. If state is unknown, require a state read before any retry.
Four panels: the moment one draft reaches outward
- Mina assigns one refund-reply draft from a ticket with a missing date and conflicting support and carrier records.
- Before the evidence is resolved, the AI reaches toward sending, case write-back, and additional tickets.
- The run hits its predeclared external-effect stop; Mina closes off the send and write-back tools and keeps only the draft and evidence.
- The marked draft and stop record are ready for review. Sending, record changes, and extra work remain locked pending separate approval.
The same claim carries through the story: define the halt before execution, stop visible scope growth at the external-effect edge, and finish only with a bounded result another person can verify and resume.
References
- Anthropic: Building effective agents (published 2024-12-19; accessed 2026-08-01) — https://www.anthropic.com/engineering/building-effective-agents
- OpenAI Agents SDK: Human-in-the-loop (accessed 2026-08-01) — https://openai.github.io/openai-agents-python/human_in_the_loop
