Approvals & Human-in-the-Loop

Agent Ops is built on a simple contract: the agent does the work, humans make the calls. Runs pause — cleanly and resumably — whenever a decision or a gated action needs a person, and resume the moment you respond. You don't babysit a terminal; the system comes to you.

Two kinds of pause

Approvals — "may I do this?"

When the agent wants to perform a gated action, the run parks as waiting_approval with the exact action and its parameters shown in the task's approval panel. Gated by default:

• Git push (per-project setting, on by default)
• Creating subtasks
• Risky or outward-facing integration operations

You approve or reject; either way the run continues — a rejection isn't a failure, the agent adapts (for example, delivering the change as a patch file instead of pushing).

Questions — "what do you want?"

When the agent hits a genuine business decision — an unsupported variance, an ambiguous requirement, a threshold breach — it asks, and the run parks as waiting_input:

The marketing spend variance is +18% over budget and I can't find a
corresponding plan change. Should I (a) flag it and adjust the forecast,
or (b) leave the forecast and escalate to the budget owner?

This is the mechanism that lets the agent handle judgment-heavy work safely: it prepares everything, surfaces the decision, and executes whichever call you make.

Email notifications

Every pause and every ending notifies the task owner by email with a deep link to the exact task:

Event	Email
Approval needed	What the agent wants to do, link to approve
Question asked	The question, link to answer
Task completed	Result summary
Task failed	What went wrong

Waits on machines (external events, other tasks) are silent — you're only interrupted when you are the blocker. This is what makes scheduled and webhook-triggered tasks safe to run unattended: the run works alone as far as policy allows, then finds you.

Policy controls

How much pauses is configurable per project (see runtime settings):

• Auto-approve safe tools keeps read-only work friction-free while gating writes.
• Read-only mode turns a project into a pure analyst — nothing gets modified anywhere.
• Require approval for git push keeps repository writes human-signed.
• Allow / auto-run child tasks controls how much work the agent can spawn on its own.
• Per-task allowed/blocked tool lists narrow a specific task further.

The adoption pattern

Teams typically hand work over in stages:

1. Watch — read-only mode; the agent analyzes and reports, touches nothing.
2. Draft — the agent produces the deliverable; a human reviews every output (approvals on everything).
3. Operate — safe tools auto-approve; humans sign only the genuinely irreversible steps.

Because every run keeps a complete record — plan, every tool call, every approval and who gave it, token usage — you can audit exactly what the agent did at every stage.