Human-in-the-loop patterns for production agents

Every framework for building AI agents ships a way to pause and ask a human: LangGraph has interrupt, the OpenAI and Anthropic agent SDKs have approval callbacks and tool-confirmation hooks, workflow tools like n8n have wait-for-input nodes. The primitive is universal because the need is universal — any agent doing real work eventually hits a step it can't or shouldn't do alone.

What no framework ships is the human. The interrupt fires, and then... what? Who sees it? How fast? What do they do, where does their output go, and what happens if they never answer?

That gap is an architecture decision most teams make implicitly, by writing whatever handler gets the demo working. This guide makes it explicit. There are four patterns, they solve different problems, and most production agents need more than one.

First, classify the interrupt

Human-shaped moments in agent workflows come in two families, and conflating them is the root of most bad HITL design:

Decisions — the agent could proceed but shouldn't without sign-off. Approving a spend, confirming a destructive action, reviewing a draft before it's sent. The human contributes judgment about the agent's own output. Latency tolerance: minutes to hours. The right human: someone who already works for you.

Labor — the agent cannot do the step at all. A notarization (law requires a credentialed human), a site photo (atoms, not bits), an expert review (the client demands a human on the hook), a verification call (trust requires an independent voice). The human contributes work the agent can't perform. Latency tolerance: hours to days. The right human: usually nobody on your payroll.

Decisions need routing. Labor needs a workforce. Keep that distinction in mind as you read the patterns.

Pattern 1: Block-and-wait

The agent pauses in place — a durable interrupt in LangGraph, a suspended workflow in Temporal — until a human responds in the same execution context.

Right when: the response arrives in seconds-to-minutes and the workflow is meaningless without it. Interactive sessions where a person is already present ("confirm sending this email"), or hard safety gates on irreversible actions.

Wrong when: the human isn't already watching. A blocked graph waiting on someone who went to lunch is a resource leak with a timeout bug attached. If you can't state who is watching the channel and their expected response time, this isn't your pattern.

Engineering notes: make the interrupt durable (survives a deploy), give every block a timeout with a defined fallback, and record the human's response as data, not just as control flow — you will want the audit trail.

Pattern 2: Queue to a human inbox

The interrupt becomes a ticket in a queue your own staff works: an approval dashboard, a review queue, a Slack channel with buttons. The agent moves on or parks; the response arrives asynchronously.

Right when: interrupts are frequent, reviewable by non-specialists on your team, and tolerant of queue latency. This is the workhorse pattern for decisions at volume — content moderation escalations, spend approvals, exception review.

Wrong when: the queue needs skills your team doesn't have (that's labor, not a decision), or volume outgrows the team and the queue becomes the bottleneck your agent was supposed to remove.

Engineering notes: the queue needs an SLA, an escalation ladder for aging items, and per-item structured context — a reviewer who has to reconstruct what the agent was doing from a chat log will make worse decisions slower. Measure queue latency; it silently becomes your workflow's p95.

Pattern 3: Escalate to the owner

The interrupt routes to the specific accountable human — the account owner, the customer, the principal — over a channel they actually check (email, SMS, push), usually with a one-tap response path.

Right when: the response requires that particular person — authorization only they can give, a document only they possess, a preference only they know. Frequency is low; the cost of interrupting a specific person is justified.

Wrong when: it's used as a catch-all. Every escalation is a small tax on a human who deployed the agent precisely to stop paying that tax. Owners who get pinged daily stop reading the pings, and then your safety valve is a rubber stamp.

Engineering notes: deep-link straight to the answer (a magic link to exactly the one question or upload, no login, no dashboard tour), make responses idempotent, and set a defined behavior for silence — remind, then degrade gracefully, then fail the workflow explicitly. Never hang forever on a human who's on vacation.

Pattern 4: Buy the work

The interrupt becomes a purchase from a business outside your organization: your agent finds a published service, orders it with structured inputs, pays for it, and consumes the deliverable.

Right when: the interrupt is labor — the wall categories: licensed acts, physical presence, specialized judgment, independent verification. Nobody on your team is a Travis County notary, and hiring one full-time for eleven filings a year is absurd.

Wrong when: the interrupt is a decision about your own risk. Don't outsource "should the agent send this contract" to a stranger; that's pattern 2 or 3.

Engineering notes — this pattern lives or dies on structure: buying from a stranger raises the bar on everything. You need business and credential verification, a price and a deliverable defined before your agent commits, a turnaround you can plan against, and a refund path that doesn't require a lawyer. You can build that supply network and trust machinery yourself — some companies genuinely should — or use a platform built for agent buyers. ROJI is our answer: a machine-readable service catalog over MCP, verified businesses, an itemized fee preview before any charge, payment straight through to the seller, and automatic refunds on a rejected order or a missed SLA. Evaluate us against the requirements above like you'd evaluate anything else.

The rule that outlasts your vendor choices: structure the handoff

Whichever patterns you use, the single highest-leverage decision is refusing free-text handoffs.

A free-text interrupt ("agent needs help with the Henderson filing, see thread") forces the human to reconstruct context, invites clarification ping-pong, and returns an answer the agent has to parse and hope about. Multiply by every interrupt, forever.

A structured handoff states, in schema:

• Context: what the agent was doing, with the relevant artifacts attached — not linked into a system the human can't access.
• The ask: one question or one deliverable, typed. If it's a question, constrain the answer (enum, boolean, number, file) so the response is machine-usable without interpretation.
• Acceptance criteria: written before the work, so "done" is a check, not a negotiation.
• The clock: deadline, whose move it is, and what silence does (remind → escalate → auto-resolve or fail — but defined).

Typed questions deserve special emphasis because they're cheap and transformative in both directions. A human asking an agent "does mutual indemnification count — yes/no?" gets an answer in seconds, because the agent can act on an enum with confidence. An agent asking a human a constrained question gets an answer it can consume without an LLM round-trip of guesswork. Free-text is where handoffs go to die; schemas are where they compound.

This is vendor-independent advice. It makes a Slack-queue pattern better, a LangGraph interrupt better, and a purchased service better. It's also, not coincidentally, how ROJI's listing and question primitives are shaped — because we think it's simply the correct engineering, whether or not you ever place an order with us.

Putting it together

A production agent typically composes patterns: block-and-wait on destructive actions, a team inbox for routine approvals, owner escalation for the questions only the principal can answer, and buying the work outright when nobody in the building can legally or practically do it.

The failure mode isn't picking the wrong pattern — it's not picking at all, and letting except: post_to_slack(...) become your company's labor infrastructure. If the interrupt volume in that channel is growing, it's telling you something: the humans are load-bearing now. Give them real infrastructure.

If pattern 4 is the gap in your stack: early-access design partners place their first order end-to-end in about ten minutes.