# What does human in the loop mean for AI agents?

A person approves, corrects or stops an AI system at set points, such as before an agent sends, pays or deletes something.

- Page: https://tecyfy.com/concepts/human-in-the-loop
- Subject: AI agents (https://tecyfy.com/concepts)
- Level: beginner
- Also called: Human-in-the-loop, HITL

An [agent](https://tecyfy.com/concepts/agent) can take dozens of actions in a minute. Human in the loop means some of them wait for a person. The agent proposes an action, a person approves or declines it, and only then does it run.

## Where the person sits

If every step waits for a person, the agent is no faster than doing the job by hand. The useful question is which actions are hard to undo or reach outside the system: sending a message, paying, deleting, changing who has access, publishing. OWASP's guidance on [prompt injection](https://tecyfy.com/concepts/prompt-injection) lists human approval for high-risk actions as a defence, beside giving the system the least access it needs.

Reading and searching can usually run on their own. Writing inside a sandbox often can too. Anything that leaves the system waits for a person.

## Build it in code, not in the prompt

The approval has to be enforced by code. A system prompt that says "ask before refunding" is a request the model may misread or be talked out of. A check in the tool, or in the code that runs the tools, holds whatever the model writes.

In the Claude Agent SDK, each tool request passes through hooks, deny rules, ask rules, the permission mode and allow rules. Anything none of them settles goes to a canUseTool callback, where your app can show the request to a person and return allow or deny. An allow can also change the input, so the person can correct an amount before the tool runs.

## Make the approval mean something

An approval screen nobody reads protects nothing. A few habits help:

- Show exactly what will happen: the tool, its inputs and the effect, not the model's own summary of them.
- Ask only where it matters, so each request gets real attention.
- Set limits that need no judgement, such as refunds over a fixed amount, so the rule is clear to the person and to the code.
- Keep a record of who approved what, and when.

## Not the same as a guardrail

A [guardrail](https://tecyfy.com/concepts/guardrail) is any check around a model, and most are automatic: a filter, a rule, a small model screening content. Human in the loop is the check that needs a person. A careful agent uses both, automatic checks for what code can judge and a person for what it cannot.

## Related

- [Agent](https://tecyfy.com/concepts/agent): A model that uses tools in a loop, deciding each next step from what the last one returned, until the task is done.
- [Guardrail](https://tecyfy.com/concepts/guardrail): Checks placed around a model that stop or change what goes in and what comes out, such as a filter on user messages or an approval step before an agent acts.
- [Prompt Injection](https://tecyfy.com/concepts/prompt-injection): An attack that hides instructions in text a model reads, such as a web page, an email or a file, so the model follows the attacker instead of you.
- [Tool Use](https://tecyfy.com/concepts/tool-use): Giving a model a list of things it can ask to have done, such as search the web or read a file. The model asks; the program around it does the work and hands back the result.

## Sources

- [LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)
- [Configure permissions](https://code.claude.com/docs/en/agent-sdk/permissions)
- [Handle approvals and user input](https://code.claude.com/docs/en/agent-sdk/user-input)
- [Mitigate jailbreaks and prompt injections](https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks)