Guide · human-in-the-loop
Human-in-the-loop tools for AI agents, by what they do
What you want from a human-in-the-loop tool is that the person who should decide is asked before the agent acts, and that you can show afterwards who decided what. Six kinds of tool do part or all of that. Which one fits depends on who has to answer, how often, and whether anyone will ask for the record.
The six kinds of tool
| Kind | What it does well, and where it stops |
|---|---|
| The agent framework's own pause | LangGraph's interrupt, the OpenAI Agents SDK and the AI SDK can stop before a tool call and wait for an answer. Right when the person running the agent is the person who decides. It does not choose an approver, reach anyone else, or keep the decision anywhere. |
| The client's permission prompt | Claude Code, Codex, Cursor and other MCP clients ask whoever is at the keyboard before a tool runs. Built in and immediate; the answer is one person's, in one terminal, and is not kept. |
| Approve buttons in Slack or Teams | A button where people already talk. Checking that the press came from the platform, that the person may decide, and keeping the record are your application's work. |
| Workflow and durable-execution engines | n8n, Zapier, Power Automate and Temporal can wait for a person inside a process they run. Strong when the whole process lives in that tool; an agent running somewhere else has to be wired in to it. |
| Authorisation services | Permit.io, Cerbos, Open Policy Agent and Cedar decide from policy, in milliseconds, whether a caller may perform an action. They answer yes or no. Asking a named person is a small part of them or not part of them at all. |
| Human-in-the-loop services | A hosted service the agent calls to ask a named person, which reaches them by email, chat or phone, handles silence, and keeps the decision. HumanLayer launched one in 2024 and has since moved to a coding-agent product; Deliverd, described below, is one today. |
Four questions that pick the tool
- Is the person who decides the person running the agent? Then the framework's pause or the client's prompt is enough, and you need nothing else yet.
- Does the decision belong to someone else — a finance lead, a client, the engineer on call? Then you need routing, and a channel that reaches them where they are.
- Should the routine cases be settled without anyone? Then you need rules in front of the people, and a person for whatever the rules do not cover.
- Will someone ask for the record — an auditor, a regulator, a client? Then who decided, what they were shown and when has to be kept where it cannot be edited, and exported.
What to check before you choose
| Check | Why it matters |
|---|---|
| The agent can never approve | An agent that can approve its own request, or anyone's, is not oversight. |
| Approve with changes | Most bad requests are one wrong figure. A reject-only answer wastes the run. |
| Escalation and expiry | A request nobody answers should move to someone else and then expire, not wait forever. |
| Cover for absence | Someone on holiday names a colleague instead of the queue stalling. |
| Rules for the routine | People should only see what needs them, or approving becomes a reflex. |
| An export someone else can check | The record is only evidence if a reader outside the team can verify it. |
| Works with the agents you run | An MCP server, SDKs and hooks mean one set of approvals for every agent, not one build each. |
How Deliverd fits
Deliverd is a human-in-the-loop service with policy in front of it: compliance at the moment of action. An agent asks a named person for approval, a review or information in one call, over an MCP server, a REST API or SDKs for TypeScript, Python, Rust and .NET, and carries on when they answer. The person decides from an email link, Slack, Teams or a page built for a phone; requests escalate, expire and can be covered, and an agent can never approve anything.
Before an action, an agent can declare it at a gate instead, and the organisation's rules allow it, refuse it or send it to a person; rules are included in Business Starter, Business and Enterprise. Every step is kept in an audit trail that refuses edits and exports as a signed evidence pack. It pairs with the framework's pause and with an authorisation service rather than replacing them.
Questions
- What is the difference between an authorisation service and a human-in-the-loop tool?
- An authorisation service answers from policy whether a caller may act, in milliseconds. A human-in-the-loop tool asks a person when policy should not settle it alone. Most teams with consequential agents need both, and they work together.
- Is HumanLayer still an option for agent approvals?
- HumanLayer's GitHub repository now says its earlier code is 'pretty much all deprecated', and the company sells a coding-agent product. Teams that used its approval SDK are looking for a maintained replacement.
- Which of these work with Claude, ChatGPT and Copilot?
- Any tool with an MCP server can be reached from Claude, ChatGPT and Microsoft Copilot clients that support MCP. Deliverd's MCP server works with Claude Code, Codex, Cursor, VS Code, ChatGPT and Claude's apps, with OAuth sign-in and no pasted token.