Problem 3 of 15 in the Harnessing Agentic AI Systems series — read the index for the framing. Previous: Static Intercepting Gatekeeper Pattern · Next: Token & Time Budget Throttler Pattern.
The Problem — Stopping the loop for a human
Some mutations — financial transactions, deletions, releases — must not happen without human authority. The loop must stop, persist exactly where it paused, and resume only after a person decides. There is no named anti-pattern; its failure modes — the rubber-stamp and the swallowed breakpoint — are in the tradeoffs.
| Field | P3 — Human-in-the-Loop (HITL) Breakpoint (pattern) |
|---|---|
| Forces | Autonomy wants the loop running; safety wants it stopped. Latency vs accountability; meaningful vs fast approval. |
| Solution | Freeze the harness execution loop to demand manual approval for high-risk mutations. Persist the exact state at the pause, then resume from that checkpoint after a human approves, edits, or rejects. |
| Consequences | Authority becomes a property of the system — a state-machine primitive, not a prompt; every human decision is recorded, making the breakpoint an audit seam. |
| Tradeoffs | Cannot run unattended without an automation path, or the harness drowns in approvals and humans rubber-stamp everything. A breakpoint that can be swallowed does not exist: interrupts must not be wrapped in try/except. |
| Evidence | LangGraph's interrupt() primitive (docs); OpenWorker's approval gates (OpenWorker outcome layer); the DeepSeek approval seam — allowed-once, missing answerer resolves to unavailable (DeepSeek teardown). |
| Related | Composes with P2 (the gatekeeper decides what is routine, the breakpoint what is consequential); the automation path it needs is P4's discipline. |
Discussion
The breakpoint makes authority a resumable property of the state machine: approval is a checkpoint, not a moment, and every human decision is recorded. Its two failure modes are failures of attention — the rubber-stamp, and the swallowed breakpoint (interrupts wrapped in try/except, which LangGraph explicitly forbids). The automation path is not an exception to the pattern; it is the pattern's other half, and its discipline is P4's: the system decides what is consequential, never the model.
Key Insight
Authority is a resumable state, not a moment. Approval without review is worse than no approval, and a breakpoint that can be swallowed does not exist. The harness decides what is consequential and what is routine; the model never does.
References
LangGraph interrupts (docs); archive: OpenWorker and the Outcome Layer, DeepSeek teardown, always-on agents.