Human-in-the-loop gates that actually work

A Cursor agent force-pushed to a user’s repo in January 2026. The user had told it in plain language to ask first, which it ignored. The “Tell HN” thread that followed is the sharpest agent-gate research I have read all year. Its fixes were not prompts. I run agents on my own marketing workflows, and the review gate is the part I keep reworking. So I collected patterns from the teams that shipped theirs. The list: Pydantic, Windmill, the Claude Code docs, and HN threads that turned into design reviews. Everything here comes from those sources, checked September 8, 2026. Where I describe my own builds, I have actually run them; vendor numbers and docs are labeled as such.

What breaks when the gate is a prompt rule

The Cursor thread’s top comments read like a design review. They all reached the same verdict: “Prompt instructions are never sufficient for this. The tool call itself needs to be gated.” One commenter banned version control access outright, which keeps commits human-reviewed. It also makes force-pushes impossible. “I prohibit agents from accessing version control at all,” he wrote. The thread’s most quoted line was blunter still: “The instructions that you give in the prompt are advisory.” The same commenter added the fix: “You must use a security system” to keep access “actually limited.”

Claude Code is the clearest shipped example, though I am working from the docs here rather than a bench test. Its permission modes control tool-call approval, while allow and deny rules like Bash(git *) settle what runs without asking. The design point survives any vendor swap. You never ask the model to behave; the ability to misbehave sits behind a check the model does not control. My own version, from the n8n agent builds I run, is narrower. The agent composes the send, while a credential it never holds does the sending.

Gate by blast radius, not by task

Review attention is the scarce resource, so the builds that hold up spend it where undoing damage costs most. Windmill automated support at scale and wrote it up in August 2026. AI drafts every customer reply, while a human presses send on all of them. Their auto-dispatch bar for code fixes is deliberately narrow. The gate’s first check is prompt injection, before anything else runs. One obvious, self-contained change goes through; anything needing a product call waits for a person.

That maps onto the tier table I use on my own builds, which sorts by what it costs to undo. Task difficulty never enters the list:

The last row is where teams keep getting burned, because self-modification compounds every other risk. Warp’s self-improving-agent post drew fire in August for exactly this. Its human review turned up later in the post, mentioned almost casually. One commenter set the threshold: an agent editing its own behavior “crosses an explicit risk threshold that requires additional controls.” My rule on my own builds matches theirs exactly. An agent that rewrites its own gate has no gate.

Approve the plan, not the paragraphs

Output review does not scale, because agent output volume grows faster than any team’s reading capacity. Pydantic’s July essay named the cost of pretending otherwise. The author spent “close to two full days writing a plan for an LLM to execute.” Changes came back anyway as “errors of coherence,” not capability gaps. The essay’s fix is review upstream: run a pre-mortem, where a fresh session assumes the plan failed and diagnoses why. Then encode past review comments into the agent’s rules file, so judgment accumulates instead of evaporating.

Windmill’s queue is the same idea in production clothes. The approval step is a flow suspend: the workflow waits, holding no worker, until someone hits send or edit. The fix path got more freedom than the replies, and their published numbers read as a tiered-gate result. Since late May: 71 pull requests opened, 62 merged, 9 closed on review. A human saw every diff, even where the dispatch was automatic.

What the human actually sees depends on the stage, and muddling the stages is how gates turn theatrical:

Make the approval carry weight

A gate without identity is decoration, because “someone approved it” must survive being asked who. Windmill signs every outgoing reply with the reviewer’s name. It says plainly that the reply was AI-drafted, and it records each pipeline action so re-runs never double-post. The audit trail does double duty: the customer sees a human signed off, while the team can reconstruct decisions later.

The pattern is early, so tooling is still thin. Agentmint, a six-star repo, exists only to produce cryptographic proof of human authorization for agent actions. The approval layers around agent memory face the same gap, since a remembered decision keeps steering later sessions. Regulation pushes the same way. The EU AI Act’s disclosure duties make the log part of compliance for certain agent interactions. You do not need a blockchain for any of this. You need a named human, a timestamp, and the diff they saw.

Run this checklist on any gate before you trust it:

• The blocked action is enforced in the tool layer, not requested in the prompt.
• Irreversible actions wait for a human, and the tier list is written down.
• Every approval carries a name, a timestamp and the artifact that was reviewed.
• Auto-dispatch has a narrow, stated bar, and an injection check ahead of it.
• Approval volume is measured, because a gate everyone rubber-stamps is theater.

Where human-in-the-loop still fails

The honest failure mode is fatigue, and the community stopped pretending otherwise in July. Pydantic’s “The human-in-the-loop is tired” pulled 318 points and 200 comments on Hacker News. Its thesis: supervision is the new bottleneck. The volume of mostly-correct output still needing your eyes keeps climbing, while the satisfying part of the work shrinks. One maintainer described waking to thirty AI-pulled pull requests a morning, each needing a snap judgment. The temptation he named is the trap: delegate the review itself to a model. “At that point, what am I still doing here?”

The designs that survive fatigue share two habits. They batch review instead of interrupting: a queue you clear twice a day beats twelve approvals scattered across the day. They shrink what gets reviewed rather than skipping review, which is what the tier and stage tables do. The MCP servers post covers the tool side of that: scope credentials so the blast radius stays small. Fatigue never yields to willpower. It yields to fewer, heavier, better-timed gates.

Filed under: AI agents, human-in-the-loop, agent workflows, automation, with more in the agents category.