Going through recordings from the GoCloud conference for my articles, I came across an interesting point about deploying driverless trains: “we keep a human in the loop, and at any doubt the system makes the safe decision – it brakes or stops, and the human then makes the final call”.

The sequence is what caught my eye: the system reduces the risk first, on its own, and only then calls the human. By the time the person steps in, the immediate risk is already down, and they can decide with less urgency.

With AI agents this loop is called Human-in-the-loop (HITL), and one version of it looks like this: execution pauses before a sensitive action and the decision goes to a human. But the pause only settles who pulls the emergency brake. It says nothing about the systems the agent has already reached.

Say an agent is processing a customer refund, and the process has 12 steps. At step 7 the system notices that the agent has strayed from the expected path and stops it.

By that point the agent has already changed the ticket status in the CRM and sent the customer an email promising a refund. The payment itself has not started, but the process is stuck halfway: the customer is waiting for the money and there is no one to finish the job.

For a train, braking at least dissipates kinetic energy and removes the main source of danger, even if stopping on a busy stretch creates problems of its own. With an agent nothing dissipates: a sent email stays sent, and the CRM status will not roll itself back.

So it seems the safe state has to be defined for the whole process, not for a single step. Once the brake is pulled, it should already be clear what the agent may still read, where it may no longer write, which actions can be compensated and at what point control passes to the human. A STOPPED status is not enough for that.

The transition itself also has to leave a trail: what has already gone out, which action was interrupted or was about to run next, and why the stop fired. That trail is written by the runtime, not by the agent that was just stopped.

As a colleague of mine used to say, “the Simpsons did it already”. OpenAI Agents SDK can pause an agent before a sensitive action, save the state of the run, wait for a human decision and then continue. But that pause will not unsend the email or undo the CRM change.

In LangGraph, once the human responds, the interrupted step runs again from the beginning. The code before the question executes a second time, so the email may go out twice. Irreversible work is best done after approval, or moved into a separate step.

OWASP recommends providing for interruption and rollback of agent operations. And in the June Cordon preprint the authors build a runtime that holds irreversible effects until the whole task commits.

For distributed systems the problem is familiar from the Saga pattern: if one of the steps fails, the completed local transactions are compensated by separate actions. But in a classic saga the flow and the compensations are designed up front, while an autonomous agent may pick its next steps as it goes. And some external consequences cannot be reversed at all: the email has been read, the data has been disclosed.

So the steps of a process need to be sorted by reversibility in advance. Run the ones that can be undone or safely repeated first. Leave the irreversible ones until after the checks, as far as the process allows.

Reversibility itself depends on timing. An email can be pulled from the queue while it has not gone out, and after delivery all that is left is a separate compensating action. A CRM status can be restored while nothing downstream has acted on it. Which means the state of the process is also determined by what has already happened outside.

There is always a price. The railway knows the cost of stopping a train and pays it for the sake of safety. For an agent, the downtime comes with unfinished work and the effort of restoring changed systems, and that price has to be accepted in advance as well.

So I would test HITL with a single question. We stopped the agent at step 7 of 12. What will the system put in order by itself, before it calls a human?