Pitstop Human in the loop
Human in the loop for AI agents, done properly
Human in the loop (HITL) means a person approves an AI system’s action before it takes effect. For agents that email clients, publish or contact candidates, the person approves this exact action, and the system can show afterwards that what ran is what was approved.
Get Pitstop for your firm- L2Ask firstActs after a person approvesAwaiting yes
Content fingerprint
46fd…6175
Fictional message, fingerprinted in your browser. Approve it, then change one word.
- The agent draftsan email, a post, a client update
- It stops at the gateL2: anything that leaves the firm waits
- A person says yesto the exact text, fingerprinted
- It leaves, or notany later edit voids the yes
The autonomy levels
Set per agent and per type of action. Whatever the setting, anything that leaves the firm stops at L2 and waits for a person. Pick a level.
Why “someone reviewed it” is not enough
Most setups stop at the first half. Somebody looks at a draft. Nothing proves what happened next. Three things break between review and sending:
- The text changes after the review. Someone adds a line, the agent regenerates a paragraph. The approved version and the sent version are no longer the same, and nothing notices.
- Approval lives in a chat. “Looks good” in a conversation is not attached to anything. It cannot be checked, searched or shown to a client.
- The agent can approve itself. If the same tool access lets an agent ask and decide, the human step is optional.
Claire, your work on the Rhône-Alpes warehouse network caught my attention. One of our clients is building the same thing at a larger scale and is looking for its next CFO. Open to a 15-minute call this week? P.S. Our client is your former employer.
Someone reviewed it
- DraftThe agent writes the approach.
- “Looks good”A partner replies in a chat.
- A line is addedAfter the review, naming the client.
- SentNot the text that was reviewed. Nothing notices.
A pit stop
- DraftFingerprint
46fd…6175 - ApprovedThe yes names
46fd…6175 - A line is addedNow
f0c4…75c3: the yes no longer counts - Blockedcontent_changed_after_approval: the agent asks again
Same edit, two outcomes. In the first lane, a confidential client is named in a message that went out. In the second, the send stops and the agent asks again.
We call this the review gap. A real human-in-the-loop setup closes all three.
Human in the loop vs human on the loop
Most firms need both, per action. That is why Pitstop sets autonomy per agent and per type of action, and caps anything external at “approve first”.
The same approach to Claire M., in two set-ups.
Human in the loop
- The agent drafts the approach to Claire M.
- It stops at the pit stop and waits
- The partner approves the exact text
- Sent, with the approved fingerprint
Nothing left the firm before a person said yes to that exact text.
Human on the loop
- The agent drafts the approach to Claire M.
- Sent at once
- A reviewer spots the wrong company name
- Too late: Claire has read it
Someone looked, after it had already left.
An illustration with a fictional message, not a client case.
Compare in detail
| Question | Human in the loop | Human on the loop |
|---|---|---|
| When the person acts | Before the action runs | After, by monitoring |
| What the agent may do alone | Nothing that needs approval | Everything, until someone stops it |
| Fits | Anything that leaves the firm: client emails, candidate outreach, posts | Internal, reversible work: research, sorting, first drafts |
| Main risk | Approval fatigue, if everything needs a yes | The wrong message is already out |
What a real setup needs
- A binding between the yes and the content. The approval names the exact content, so any change voids it.
- Separation of powers. Agents can request. Only people decide.
- A record nobody can quietly edit. Who asked, who decided, what and when, in a log that shows any tampering.
- Levels, not a single switch. Read only, suggest, approve first, act and report, autonomous, set per action.
- A fast decision. If approving takes five minutes, people stop doing it.
How a pit stop works, step by step
Pitstop is a remote MCP server your agents call from ChatGPT, Claude or Codex. Here is one pit stop, from request to proof.
- 01
The agent connects
With standard OAuth (PKCE). The scope it receives,
pitstops:agent, lets it request validations, read their status and report what it executed. The consent screen says it plainly: it cannot approve, edit or refuse anything. - 02
The agent asks
It calls Request a human validation with the content, the action type (an external send, a publication, an internal task) and the consequences it expects. Pitstop computes a SHA-256 fingerprint of the content.
- 03
Pitstop applies the agent’s level
At L0 the request is refused. At L1 and L2 it waits for a person. At L3 and L4 internal tasks are approved on submission and journaled. External sends and publications always wait for a person.
- 04
A person decides
In the Validations inbox, on desktop or phone: approve, edit (with a line-by-line diff) or refuse (a reason is required and goes back to the agent). The decision carries the fingerprint the person saw. If the content changed in between, the decision is rejected and the screen says so.
- 05
Someone outside the firm can decide too
A one-time approval link lets a client or a colleague without an account approve that one request.
- 06
The agent executes and reports
It reads the decision, uses the approved (or edited) content, and journals the execution with the approved fingerprint. Another fingerprint voids the approval:
content_changed_after_approval. - 07
The journal proves it
Every event is hash-chained to the previous one. “Verify the chain” recomputes it and reports any gap or altered line. Export to CSV or JSON.
pitstops:agent
What an agent’s access allows
- Request a human validation
- Read the status of its requests
- Report what it executed, with the fingerprint
- Approve a request
- Edit the content
- Refuse on someone’s behalf
Building it yourself: what each framework gives you
Three common ways to pause an agent for a person. Each gives you the pause. None of them, on its own, ties the yes to the exact content or keeps a record a client can check.
| Framework | How it pauses | What you still build |
|---|---|---|
| LangGraph | interrupt() inside a node stops the graph, a checkpointer keeps its state, and Command(resume=…) on the same thread_id continues it. | The binding between the decision and the exact text, an inbox for people who are not developers, and a journal nobody can quietly edit. |
| OpenAI Agents SDK | A tool declared with needsApproval stops the run. Pending calls are listed in result.interruptions; state.approve() or state.reject(), then a new run, continues it. | The same three. |
| MCP elicitation | During a tool call, the server sends elicitation/create to ask the user, who accepts, declines or cancels. | Who is allowed to decide (anyone at the client can answer), the fingerprint and the record. |
Sources: LangGraph, interrupts · OpenAI Agents SDK (JavaScript), human in the loop · MCP specification 2025-06-18, elicitation. Checked on 10 October 2026.
Keeping approvals from becoming a rubber stamp
Approval fatigue is the main risk of human in the loop: when everything needs a yes, people stop reading. Five habits keep the yes meaningful.
- Ask only where it matters. Internal, reversible work can run at L3 and be journaled. Only what leaves the firm waits for a person.
- Decide in one sitting. One inbox gathers the requests, so a partner decides the morning’s approaches together instead of being interrupted all day.
- Show what changed. An edit comes with a line-by-line diff, so the reviewer reads the difference, not the whole text again.
- Make refusals teach. A refusal needs a reason, and the reason goes back to the agent with the request.
- Check the yeses, not only the sends. Every request and decision in the journal carries its time. A run of approvals given seconds after each request means nobody is reading.
What the EU AI Act asks for
Article 14 of the EU AI Act requires high-risk AI systems to be designed so that people can effectively oversee them.
- Understand the limits. The people in charge must know what the system can and cannot do, and notice when it behaves oddly.
- Resist automation bias. They must stay aware of the habit of trusting the output too much.
- Override and reverse. They must be able to decide not to use the output, or to override or reverse it.
- Stop it. They must be able to interrupt the system.
Annex III lists AI used for recruitment or selection, including to evaluate candidates, among high-risk uses. An agent that drafts a meeting brief is not on that list; one that ranks candidates can be. A pit stop covers part of the duty: a person can refuse or edit before anything leaves, and the journal shows what was decided. It does not, by itself, make a system compliant.
Sources: AI Act, Article 14 · Annex III, point 4.
Proof you can check, line by line
- Every event is recorded. Requests, decisions, executions and reports, each with its time, its author and the fingerprint of the content.
- Each line is chained to the one before. A line’s hash includes the previous line’s hash. Edit any line of the journal and verify: the chain breaks exactly there.
- Security, in plain terms. Hosting on AI Jungle’s own servers in Germany (EU). Agents connect with OAuth and PKCE and never receive a permission to decide. Export or erasure of a workspace on request; on the free plugin, history is kept 30 days.
Firm journal · fictionalSHA-256
| Time | Journal line | Hash | Check |
|---|---|---|---|
········ | |||
········ | |||
········ | |||
········ | |||
········ |
Computed in your browser with SHA-256. Change any line, then verify.
Questions about human in the loop
The idea
Is human in the loop the same as approval workflows?
Close. A workflow tool routes a document to someone. Human in the loop for agents also binds the approval to the exact content and keeps the agent from deciding on its own.
Does human in the loop slow agents down?
Only where you choose. Internal work can run at L3. Only what leaves the firm waits, and approving takes one tap.
What is human on the loop?
The person monitors and can stop the agent, but does not approve each action beforehand. Fine for internal, reversible work.
With Pitstop
Which agents work with Pitstop?
Any agent that speaks MCP with OAuth, including ChatGPT, Claude and Codex.
Can an agent approve its own request in Pitstop?
No. Its access lets it request validations and read their status. It cannot approve, edit or refuse.
What happens if the text changes after approval?
The fingerprint no longer matches, so the approval stops counting and the agent has to ask again.
See it on your own agents.
Pitstop puts the pit stop between your agents and everything that leaves the firm, inside the workspace your team already shares. One price per firm.