Long-running automation needs human checkpoints inside the flow, not just at the start.
← Back to patterns
Magentic-UI: Towards Human-in-the-Loop Agentic Systems Computer Use · Claude 3.5 Sonnet
Agent Workflow
Approval Gates
Human Checkpoints Inside Autonomous Workflows
Unlike upfront plan review, Approval Gates are embedded inside long-running workflows. The agent pauses at predefined checkpoints, shows what it plans to do next, and waits for human sign-off before proceeding. The safety net for high-stakes agentic execution.
Metaphor
Checkpoint
Interaction
Review, Approve, Redirect
Use case
Code Deployment, File Operations, Multi-Step Agent Tasks
Failure mode
Weak Intervention
Control mechanisms
Gate Diamonds · Approve/Edit/Abort · Status Timeline
Reference examples
LangGraph Human-in-the-Loop · n8n Human Review Step · Cursor Agent Run Modes
Interactive Example
The live side-by-side is the comparison.
This prototype already contains the contrast between chat and the pattern response. It stands as the primary comparison surface for this page.
Reviewing the plan at the start is not the same as catching it mid-flight.
Upfront plan review assumes the risky moment is at the beginning. In long-running automation it rarely is. The consequential step often arrives ten actions deep, after the plan has met reality, and conversation cannot reliably interrupt a hidden downstream step at exactly the right moment.
Approval Gates embed human checkpoints inside the flow at predefined positions. The agent pauses, shows what it intends to do next and why, and waits for an approve, edit, or abort before proceeding. Because users know in advance where the gates sit, oversight lands on the actions that matter rather than every keystroke — provided the gates stay rare enough to resist rubber-stamping.
Put the checkpoint where the risk is, not where the workflow happens to begin.
DOPE Lens
How this pattern improves AI interaction quality.
Observability
Upcoming actions visible at each gate before execution
Directability
Approve, edit the plan, or abort at each checkpoint
Predictability
Gate positions are predefined — users know exactly when they'll be asked
Explainability
Each gate shows what the agent plans to do next and why before proceeding
Fit
Where it earns its place.
Use it
when
when
Long-running automation has discrete decision points that require human judgement mid-flow.
Avoid
when
when
The sequence is fully reversible and low-risk end to end.
In the wild
Where this pattern already ships.
Real implementations from products users already know. Each entry shows how the pattern got applied — what shipped, where it sits in the product, what it traded off.
LangGraph Human-in-the-Loop
LangChain
interrupt() plus the human-in-the-loop middleware: a tool call matching the configured mapping pauses the graph, state is checkpointed so the run can resume later, and the human returns approve, edit, reject or respond. The gate fires on the tool itself, not on a classifier's read of it. The canonical developer-API expression of the pattern.
Visit LangChain ↗
n8n Human Review Step
n8n
n8n 2.6 (Jan 2026) put the gate on the Agent-to-tool connection: 'Add human review step' opens the Tools panel, you pick a channel — Slack, Teams, Gmail, Telegram, in-app chat — and the gated tool cannot run until someone hits Approve. Deny cancels the action outright. No Wait node to wire up.
Visit n8n ↗
Cursor Agent Run Modes
Cursor
Three run modes — Auto-review (the docs' recommended default since 3.6, May 2026), Allowlist, Run Everything. A classifier triages Shell, MCP and Fetch calls: known-safe ones run, riskier ones are held for approval. Gate positions are no longer predefined, and the old step cap is gone — the docs now say tool calls are unlimited.
Visit Cursor ↗
Magentic-UI: Human-in-the-Loop Agentic Systems
Academic source · Mozannar, Bansal, Tan et al. (Microsoft Research, Jul 2025)
Gates by irreversibility rather than by tool category: every proposed action carries an always / maybe / never-irreversible class, and the ambiguous middle goes to an LLM judge before the human sees it. The shipped build defaults to require_approval_untrusted — read-only calls auto-approved, untrusted ones prompted.
Visit Academic source · Mozannar, Bansal, Tan et al. (Microsoft Research, Jul 2025) ↗
Research Frame
Why this pattern exists, and where it breaks.
Pause execution at predefined gates for approval, edit, or abort.
Conversation cannot reliably interrupt hidden downstream steps at the right moment.
Too many gates destroy automation gains and train users to rubber-stamp.
Common questions
What people ask about this pattern.
When should I use the Approval Gates pattern?
+
Long-running automation has discrete decision points that require human judgement mid-flow.
When should I avoid the Approval Gates pattern?
+
The sequence is fully reversible and low-risk end to end.
What problem does Approval Gates solve?
+
Long-running automation needs human checkpoints inside the flow, not just at the start.
Why is chat the wrong fit for this?
+
Conversation cannot reliably interrupt hidden downstream steps at the right moment.
Grounded in Research
Not just opinion.
The papers, guidelines, and usability studies this pattern rests on.
Hussein Mozannar, Gagan Bansal, Cheng Tan, Adam Fourney, Victor Dibia, Jingya Chen et al.
Microsoft Research · 2025
Concrete system for human-in-the-loop agentic workflows: co-planning, per-action-class guardrails, intervention mechanisms. Practical UI patterns for agentic oversight.
Anthropic
Anthropic · product announcement + research note · 2024
First production model trained to operate a computer interface directly. Turns every UI question (preview, audit, gates, friction) into a concrete shipping setting and provides the destructive-action-confirmation primitive several patterns build on.
Related Patterns
Curated connections, not just neighbors.
Hand-picked relationships — what this pattern pairs with in practice, what it replaces, what it builds on, and what builds on it.
Often paired with
Intent Preview
Intent Preview shows the plan, scope, and risk before the run starts; Approval Gates then stop it at set checkpoints.
Often paired with
Action Audit & Undo
Gate the steps you cannot take back; let the rest run and undo them from the Action Audit & Undo timeline.
Often paired with
Autonomy Dial
Autonomy Dial sets per tool which actions ask first; Approval Gates are where that asking happens, mid-run.