Agentspay

Explainer

Human in the Loop AI: HITL AI Agents, Human on the Loop, and Automation Workflows

Every guide to human in the loop AI describes the same shape: the agent pauses, a person decides, the agent continues. The shape is right. What almost none of them ask is a harder question, which is where the pause is enforced, because a pause written into the agent's own code is a pause the agent is trusted to honor.

Agent Payments Console

Pick an agent

Payment intent

intent:

Policy evaluation

Human approval required

This spend is over your approval threshold. Approve it to issue a scoped card, or deny it.

Scoped virtual card issued

Agentspay

single-use

Wallet budget

spent of

Audit trail

In short

Human in the loop AI (HITL) is a design pattern where an AI system stops before a consequential action and waits for a person to approve, reject or correct it. It differs from human on the loop, where the system acts and a person monitors and intervenes only when something looks wrong. In agent workflows the gate is normally implemented in the application layer, using a framework interrupt, a policy check or a Slack approval. That works when the agent is cooperative. It stops working when the action is irreversible and the agent already holds the credential that performs it, because the code that is supposed to pause is the same code that could skip the pause. For irreversible actions, the approval has to be enforced by the system that executes the action rather than requested by the system that wants to take it.

What is human in the loop AI?

Human in the loop AI is any arrangement where a person is a required step in an automated decision rather than an optional reviewer of it. The model or the agent does the work, then execution halts at a defined point and a human approves, rejects or edits the result before anything downstream happens. The term came out of machine learning, where the human was usually labeling data or correcting predictions so the model could improve. In 2026 the dominant meaning has shifted. The human is much less often training a model and much more often authorizing an action, because agents no longer just produce text. They book, buy, deploy, refund and send. The label stayed the same while the stakes underneath it changed completely, which is why a lot of HITL advice written for annotation pipelines reads oddly when you try to apply it to an agent with a corporate card.

What does human in the loop mean in practice?

It means three concrete things, and a design that is missing any of them is not really HITL. First, there is a defined trigger: a rule that says which actions stop and which do not, whether that is a dollar threshold, a risk score, a category of operation or a confidence level. Second, there is a blocking wait: the action genuinely does not proceed while the request is outstanding, as opposed to proceeding while a notification goes out in parallel, which is the most common way teams accidentally ship human on the loop and call it human in the loop. Third, there is a recorded decision tying the outcome to a named approver at a timestamp, because an approval nobody can reconstruct later is not a control, it is a courtesy. The trigger determines your throughput, the blocking wait determines whether the control is real, and the record determines whether you can prove any of it happened.

Human in the loop vs human on the loop: what is the difference?

The difference is whether the human is inside the critical path or beside it. Human in the loop puts the person before the action: nothing happens until somebody says yes, so the failure mode is delay. Human on the loop puts the person after it: the system acts and a supervisor watches, so the failure mode is that damage is already done by the time anyone looks. Human out of the loop removes the person entirely and relies on the policy itself. None of these is the correct answer in general and mature systems run all three at once, sorted by consequence, which is the actual design decision most teams skip. Autopilot is the standard illustration of human on the loop: the aircraft flies and the pilot supervises. A loan approval that an underwriter has to sign is human in the loop. The table below sets them side by side, and we go deeper into the tradeoff in human in the loop vs human on the loop.

The four human in the loop patterns for AI agents

Almost every implementation is one of four patterns, and they are frequently combined. Interrupt and resume is the framework-native approach: the graph hits a checkpoint, state is persisted, execution suspends and a human response resumes it. LangGraph's interrupt primitive is the reference implementation and CrewAI, AutoGen and the agent SDKs all have an equivalent. Human as a tool inverts it, exposing a person to the model as just another callable, so the agent decides for itself when to ask, which is flexible and exactly as reliable as the model's judgment about when to ask. Policy-driven approval gates take the decision away from the model: an external rule engine evaluates the proposed action against a policy and routes it for sign-off when it matches, so the trigger cannot be reasoned away by the agent. Fallback escalation handles the residual case, sending anything the agent cannot complete to a queue rather than letting it improvise. Patterns one and two put the trigger inside the agent. Patterns three and four put it outside. That distinction matters more than the framework you pick.

Where the gate is enforced: advisory approval versus enforced approval

This is the part the standard HITL literature leaves out, and it is the whole game once agents touch money or infrastructure. An advisory approval lives in the agent's own execution path. The graph checks whether it should pause, and it pauses, because that is what the code says. It is a genuine control against the failure mode it was designed for, which is a well-behaved agent doing something ill-advised. It is not a control against a mis-specified graph, a retry that re-enters on a path with no checkpoint, a prompt injection that steers the agent down a different branch, or plain ordinary code that calls the payment API directly because someone was in a hurry. In all of those the credential still works, so the action still completes. An enforced approval lives in the system that actually performs the action. The agent can request the charge as many times as it likes and the authorization is declined until a human releases it. The practical test is simple and worth applying to your own design: if the agent were compromised or simply buggy, would the approval still hold? If the answer depends on the agent behaving, the approval is advisory. For reversible work that is completely fine, and paying rail-level enforcement costs for a draft email would be silly. For money, it is the difference between a control and a convention.

Human in the loop automation: setting thresholds without destroying throughput

The reason HITL projects fail is almost never that the gate did not work. It is that the gate worked on everything, approvers stopped reading, and rubber-stamping set in, which is worse than no gate because it manufactures an audit trail of approvals nobody actually made. Automation bias is a documented risk in oversight design and it gets stronger the more approvals a person sees, so volume is the enemy. Set the trigger so the queue is small enough that each item genuinely gets read. In spend terms that usually means a threshold well above the median transaction and a hard cap far below the worst case, with an allowlist doing the work in between so that routine, in-policy activity never generates a request at all. Route by consequence rather than by category, add escalation and a timeout with a safe default, and instrument the approval rate: if approvers are saying yes more than about nine times in ten, your threshold is too low and you are training them not to look. The point of the gate is to concentrate human attention where it changes the outcome, not to spread it thinly across everything.

Human in the loop AI examples across real workflows

The pattern shows up wherever an automated judgment has a consequence somebody owns. In lending, a model scores an application and an underwriter signs the decision. In clinical settings a radiologist confirms or overrides a detection before it reaches a chart. In content moderation the classifier handles volume and the borderline cases route to a reviewer. In hiring, a screening agent ranks candidates and a recruiter makes the call, which is the textbook case because the model narrows the field and the human owns the outcome. In software delivery, an agent opens the pull request and a maintainer merges it. And in procurement and finance, an agent assembles the order and a person releases the payment. The last group is the one where the gate has to be enforced rather than advisory, because a bad merge can be reverted and a settled payment cannot. We cover the money case specifically in procurement agents and human in the loop AI payments.

Why is human in the loop important?

Three reasons, and only the third is new. Agents are confidently wrong in ways that are hard to detect from the output alone, so a fluent, well-structured, entirely mistaken plan reads exactly like a good one. Some actions are irreversible, and the asymmetry between a few seconds of latency and an unrecoverable outcome is enormous. And oversight is increasingly a compliance requirement rather than a design preference: Article 14 of the EU AI Act requires high-risk systems to be built so that a natural person can effectively oversee them, including understanding the system's limits, guarding against over-reliance on its output, and being able to override it or stop it outright, with obligations for high-risk systems on the EU market applying from 2 August 2026. That reaches US companies that place products on the EU market, and even for teams entirely outside its scope it is a reasonable description of what functioning oversight looks like. The new part is scale: one person could plausibly review every decision a single analyst made, and cannot review every decision a fleet of agents makes, which forces the trigger design discussed above. Approval thresholds are one control inside a broader AI agent governance program, alongside per-agent identity, spend caps and an audit trail that names the agent.

How do you implement human in the loop for an AI agent?

Start by sorting actions by reversibility rather than by importance, because reversibility is what determines whether an advisory gate is sufficient. Reversible actions get no gate or a monitoring gate. Irreversible, low-value actions get a policy limit and no human. Irreversible, high-value actions get a blocking approval enforced outside the agent. Then implement in two layers. In the agent layer, use your framework's interrupt primitive with durable state so a pause can survive a restart, and make sure the resume path cannot be reached without the approval token. In the execution layer, put the real limit on the credential itself, so the agent asking twice does not get twice the money. For payment actions that means a funded wallet with a hard cap, a merchant and category allowlist, an approval threshold above which the authorization is held pending a one-tap approve or deny, and an audit trail binding each decision to an agent, a task, a policy verdict and a named human. That combination is what Agentspay provides, and the console at the top of this page runs the same policy engine. The surfaces are human approvals, agent spend controls and the agent audit trail. If you are still scoping the wider problem, agentic payments explained covers the rails and AI agent cost covers what an agent spends before anyone sets a limit.

Whatever standard moves the money, Agentspay is the rail-neutral control plane that keeps it governed. See how it works and the control surfaces that enforce policy, approvals, and audit on every transaction.

Oversight models

Human in the loop vs human on the loop vs human out of the loop

These are not competing philosophies. A working system runs all three at once, sorted by how bad the worst case is.

Model Where the human sits Latency added Use it when How it fails
Human in the loop (HITL) Before the action. Execution blocks until a person decides Seconds to hours The action is irreversible or expensive Queue volume grows, approvers rubber-stamp
Human on the loop (HOTL) Beside the action. The system acts, a person monitors and can intervene None High volume, low individual consequence Nobody is watching at 3am, damage is already done
Human out of the loop Nowhere. Policy alone decides None Routine, in-policy, cheap and reversible The policy was wrong and nothing caught it
Human as a tool Called by the agent when the agent judges it necessary Variable Ambiguity the model can recognize The model does not recognize that it should ask

Where the gate holds

Advisory approval versus enforced approval, and what each survives

Apply one test to your own design: if the agent were compromised or simply buggy, would the approval still hold?

Approval lives in Typical mechanism Survives a buggy or hijacked agent Right for
The agent graph Framework interrupt and resume checkpoint No. The code that pauses is the code that could skip the pause Reversible steps: drafts, plans, PRs, messages
The model's judgment Human exposed to the agent as a callable tool No. Asking is discretionary by design Ambiguity handling, not risk control
A policy service External rule engine evaluates the proposed action Partly. The agent cannot reason the trigger away, but it can bypass the service Access control and routing decisions
The executing system The authorization itself is declined until released Yes. The credential does not work until a human releases it Irreversible actions: payments, transfers, production changes

Frequently asked

Questions people ask about Human in the Loop AI

What is human in the loop AI?

Human in the loop AI is a design pattern where an AI system stops before a consequential action and waits for a person to approve, reject or correct it. The model does the work, execution halts at a defined trigger, and nothing downstream happens until a human decides. The decision and the approver are recorded.

What does human in the loop mean?

It means a person is a required step in an automated decision rather than an optional reviewer of it. In practice that needs three things: a defined trigger for which actions stop, a genuinely blocking wait so the action cannot proceed meanwhile, and a recorded decision tied to a named approver at a timestamp.

What is the difference between human in the loop and human on the loop?

Human in the loop puts the person before the action, so nothing happens until somebody approves and the failure mode is delay. Human on the loop puts the person beside it, so the system acts while a supervisor monitors and the failure mode is that damage is done before anyone looks. Most real systems use both.

What is an example of human in the loop?

A model scores a loan application and an underwriter signs the final decision. A screening agent ranks candidates and a recruiter makes the call. An agent assembles a purchase order and a person releases the payment. In each case the automation narrows the work and a named human owns the consequence.

Why is human in the loop important?

Because agents are confidently wrong in ways that are hard to spot from the output, because some actions cannot be undone once they complete, and because oversight is now a compliance requirement in places. Article 14 of the EU AI Act requires high-risk systems to be effectively overseeable, including the ability to override or stop them.

How does human in the loop work?

A trigger rule marks certain actions as requiring sign-off. When the agent proposes one, execution suspends and its state is persisted. A request goes to an approver in Slack, email or a webhook with the action summary. On approval the agent resumes from the saved state. On denial or timeout it stops and the outcome is logged.

How do you implement human in the loop in an AI agent?

Sort actions by reversibility first. Use your framework interrupt primitive with durable state for the agent layer, so a pause survives a restart. Then put the real limit in the executing system, not the agent, so an approval on an irreversible action holds even if the agent misbehaves or is hijacked.

What is HITL in AI?

HITL is the standard abbreviation for human in the loop. It originally described people labeling data and correcting model predictions during training. With agents the meaning has shifted toward authorizing actions at runtime, because agents now book, buy, deploy and send rather than only producing text.

When should you use human in the loop instead of full automation?

When the action is irreversible, expensive, or carries a consequence a named person has to own. Reversible work should run unattended, because gating everything floods approvers and produces rubber-stamping. If your approval rate is above roughly nine in ten, the threshold is set too low.

Keep reading

More explainers

ServiceNow AI Control Tower

ServiceNow AI Control Tower

ServiceNow AI Control Tower is the most complete agent inventory and risk console a large US enterprise can buy, and it now reaches across AWS, Google Cloud and Azure. We read the schema ServiceNow ships to developers to answer the one question the rollout meeting always ends on: can it stop an agent from spending money? It cannot, and the reason is written into the data model.

Read

Gemini Enterprise

Gemini Enterprise

Google did something in August 2026 that the other agent platforms have not done: it shipped a hard monthly spend cap that genuinely stops usage instead of emailing you about it. That deserves credit, and it also moves the interesting question one step along. A cap that stops something is only as useful as the thing it is scoped to, so we went and measured what Google can actually point that cap at, in the API model Google publishes for anyone to read.

Read

Salesforce Agentforce

Salesforce Agentforce

Agentforce is the largest agent platform any US enterprise is likely to already own, and it moved to consumption billing, which means the meter now runs on what your agents do rather than on how many seats you bought. That raises a finance question the rollout deck rarely answers: when an Agentforce agent is loose in production, what actually stops it spending. We went and measured the answer in Salesforce own published object model rather than guessing at it.

Read

AWS AgentCore

AWS AgentCore

Amazon shipped the missing piece in August 2026. Bedrock AgentCore Payments went generally available, and it is a real payments product: an agent can now hold a wallet, meet an HTTP 402, pay, and carry on reasoning without a human in the loop. So the question a platform lead has to answer stopped being whether AWS gives agents money and became a narrower, more awkward one: how much of a spend policy did AWS actually ship? We went and measured it, property by property, in the API model AWS publishes.

Read

Microsoft Agent 365

Microsoft Agent 365

Microsoft shipped a control plane for AI agents, and it is a good one. It gives every agent an identity, a registry entry, an owner, a sponsor and a Conditional Access policy. Then somebody in finance asks the obvious follow-up question: fine, but what stops the agent from spending money? This page answers what Agent 365 costs, what it governs, and what we measured when we went looking for a dollar amount anywhere in Microsoft's agent governance surface.

Read

QuickBooks MCP Server

QuickBooks MCP server

Connecting an accounting system to an AI assistant is now a ten minute job. Deciding what that assistant is allowed to do once it is connected is the part nobody writes about, and it is the part your controller will ask about first. This page compares what the official QuickBooks, NetSuite and Xero MCP servers actually hand a model, measured rather than summarized from marketing pages.

Read

Payment MCP Servers

payment MCP servers

Every large payment company shipped an MCP server in the last eighteen months, and almost every write-up of them is a setup tutorial. The setup is the easy part. The question worth answering before you connect one to a production account is narrower and much less comfortable: what, exactly, can the model on the other end of that connection do to your money?

Read

PayPal Agentic Commerce

PayPal Agentic Commerce

PayPal made a bet that most merchants would rather not implement a commerce protocol at all. Where Stripe and OpenAI shipped a spec for you to build against, PayPal shipped two products that sit on top of the checkout you already have, and then bought a company to make the catalog half work. That choice is the whole story: it explains why Agent Ready needs almost no engineering from you, why there is nothing for an agent to discover about your store on the open web, and why the thing PayPal will not do for you is the thing that gets expensive later.

Read

Shopify Agentic Commerce

Shopify Agentic Commerce

Shopify switched agentic commerce on by default, so your store is probably already selling to AI assistants whether or not anyone on your team configured it. Instead of restating the announcement, we checked something you can check too: on September 2, 2026 we requested the machine-readable capability file that Shopify publishes for real storefronts, on fourteen well-known US brand domains, and read what it exposes to an agent. Eleven answered correctly. The three that did not share one trait, and it is quietly costing them agent traffic.

Read

Web Bot Auth

Web Bot Auth

Web Bot Auth is the reason your agent either gets served or gets throttled with the scrapers. Almost everything written about it repeats the same architecture diagram, so we did something different: on September 1, 2026 we fetched the published key directories of more than twenty major AI operators and infrastructure vendors to see who is genuinely signing their traffic. Four were. The results are in the first table.

Read

Tempo Blockchain

the Tempo blockchain

Tempo is the payments chain Stripe and Paradigm built, and it shipped with a protocol that lets software pay for things on its own. It settles machine payments in under a second. It has nothing at all to say about whether your agent should have paid.

Read

AI Agent Governance

AI agent governance

Every agentic AI governance framework published so far governs the same four things: identity, tools, data and prompts. Not one of them carries a budget. Here is what the real frameworks say, which guardrails actually bind at runtime, and what to do about the last mile none of them reach.

Read

A2A Protocol

A2A Protocol

Most explanations of the A2A protocol stop at the sentence that agents can now talk to each other. That was true in April 2025 and it is no longer the interesting part. A2A shipped version 1.0 in April 2026 under Linux Foundation governance, it runs in production inside Azure AI Foundry and Amazon Bedrock AgentCore, and the questions engineers actually get stuck on are narrower: what an Agent Card commits you to, when to reach for MCP instead, and what happens the first time one of your agents has to pay another one for the work. That last question has a specific answer, and it is not in the core spec.

Read

Mastercard Agent Pay

Mastercard Agent Pay

Nearly every article about Mastercard Agent Pay is a retelling of one press release from April 2025, the one where Mastercard said AI agents would be able to shop with Agentic Tokens and named Microsoft as the first platform. That was sixteen months ago, and four more things have shipped since. Reading only the launch coverage leaves you with roughly a quarter of the picture, and the missing three quarters are the parts that decide whether you can actually put this into production.

Read

Visa Intelligent Commerce

Visa Intelligent Commerce

Almost everything written about Visa Intelligent Commerce is a retelling of the April 2025 announcement, when Visa said AI agents would be able to pay with a Visa credential. Three more things have shipped since, including an open agent-identity protocol built with Cloudflare that most coverage does not mention at all. This page is the current version, checked against Visa’s own developer documentation and newsroom in August 2026.

Read

Stripe agentic commerce

Stripe agentic commerce

Most writing about Stripe and agentic commerce is still a retelling of the September 2025 launch week, when Stripe and OpenAI shipped Instant Checkout and published the Agentic Commerce Protocol together. Stripe has built a good deal more since then, and some of it points in a direction the launch coverage never anticipated. This page is the current version, checked against Stripe’s own documentation in August 2026.

Read

ChatGPT Instant Checkout

ChatGPT Instant Checkout

Almost every guide to ChatGPT Instant Checkout still reads like it was written the week it launched, walking merchants through how to apply and what the fee will be. OpenAI changed course in March 2026. Here is the accurate version: what Instant Checkout was, what the numbers actually looked like, what replaced it, and which parts of the stack are still very much alive.

Read

Google AP2

Google AP2

Most guides to Google AP2 still describe an Intent Mandate and a Cart Mandate, because most of them are rewrites of the September 2025 launch post. The specification moved. Here is what the Agent Payments Protocol actually defines today, and the one question it deliberately does not answer.

Read

AI agent cost

AI Agent Cost

Every cost guide for AI agents answers the same two questions: what does it cost to build, and what does it cost to run. Both are answerable, and both are on somebody's invoice. The third question is the one that ends up in a variance report, because the agent also spends your money, and nobody sends you a bill for that.

Read

Agentic checkout

Agentic Checkout

Nearly every guide to agentic checkout is written for the merchant who wants to receive these orders. Far fewer are written for the company whose agents are placing them, which is odd, because agentic checkout quietly removes the one screen where spending used to get a second look.

Read

API monetization

API Monetization

Most guides to API monetization argue about which pricing model wins. The harder question in 2026 is who is calling. An API priced for a signed-up developer with a key behaves very differently when the caller is an agent that showed up once, wants one record, and has no account.

Read

x402 protocol

x402 Protocol

x402 took the one HTTP status code the web never used and turned it into a payment rail machines can drive. The protocol is elegant and genuinely small. The part it deliberately leaves to you is the budget.

Read

AI procurement agents

AI Procurement Agents

Every major procurement suite shipped agents during 2026. Almost none of them answer the question your controller will ask first, which is what happens when the agent is wrong about a purchase and the money has already moved.

Read

Agentic payments

Agentic Payments

Agentic payments move money with no human at the checkout. The rails to do it all shipped during 2026. The part most teams have not solved is deciding, before the money moves, whether the agent was allowed to spend it.

Read

AI agent monetization

AI Agent Monetization

Every AI agent company is rewriting its price list. The models that survive are metered. The ones that quietly fail are the ones where nobody measured what a single task costs to serve.

Read

Agent payment platforms

AI Agent Payment Platforms

Five different kinds of product now call themselves an AI agent payment platform, and they solve five different problems. Picking the wrong category is the expensive mistake, not picking the wrong vendor inside a category.

Read

Universal Commerce Protocol

the Universal Commerce Protocol (UCP)

Google and Shopify shipped UCP as an open standard so an AI agent can check out at any merchant that supports it. Here is what the specification actually defines, where it is live for US buyers, and the one thing it deliberately leaves to you.

Read

MCP Payments

MCP Payments

MCP payments are how an AI agent discovers a payment tool and calls it to move money. The catch: the Model Context Protocol carries the tool call, not the spending decision, so nothing in the stack asks whether the purchase should have happened.

Read

Visa Intelligent Commerce vs Mastercard Agent Pay

Visa Intelligent Commerce vs Mastercard Agent Pay

Visa Intelligent Commerce and Mastercard Agent Pay are the two big card networks racing to let AI agents pay. They take different routes to the same idea, and neither one decides whether a given purchase should have happened.

Read

Agentic Commerce Protocol

the Agentic Commerce Protocol

ACP is the open standard behind agentic checkout in ChatGPT. It tells a merchant how to sell to an AI agent. It says nothing about whether your agent should have made the purchase.

Read

AP2 vs ACP vs x402

AP2 vs ACP vs x402

AP2, ACP, and x402 are the three standards shaping how AI agents pay. They solve different layers of the problem, and most real systems will touch more than one.

Read

Machine payments protocol

Machine payments protocol

As software starts paying software, machine payments protocols define how value moves without a human at the keyboard. The harder question is how to keep that spending governed.

Read

Know Your Agent (KYA)

Know Your Agent

KYA, or Know Your Agent, extends the idea of customer due diligence to autonomous software. When an agent spends, you need to know which agent, on whose authority, and under what limits.

Read

Keep agent spending governed

Add policy, hard limits, human approval, and an immutable audit trail across any protocol or rail. Start in the sandbox today.

Never moves money without policy