Skip to content
JavaAgentic

Type at least two characters. Try “RAG”, “pgvector” or “tool calling”.

Human-in-the-Loop (HITL) Systems

Design human-in-the-loop AI systems in Java: approval flows for agent actions, escalation patterns, confidence thresholds and feedback loops — how to deploy autonomy without accepting unbounded risk.

Intermediate4 min readUpdated
On this page

Full autonomy is rarely the goal; useful autonomy with human judgement at the right points usually is. Human-in-the-loop design is how you deploy agents that do real work without accepting the risk of letting them act unsupervised on consequential things. This tutorial covers the patterns.

Key Takeaways

  • The agent proposes; a human disposes on consequential actions.
  • Gate by the cost of being wrong, not the difficulty of the task.
  • Confidence thresholds route uncertain decisions to humans, automate confident ones.
  • Good HITL still automates the work — the human only makes the final call.

The propose-dispose pattern

The foundational HITL design: the agent does everything up to the consequential action, then waits.

Propose then dispose
public Proposal proposeAction(String task) {
    // The agent investigates and drafts the action — all the work.
    Investigation investigation = agent.investigate(task);
    ProposedAction action = agent.draft(investigation);
 
    // But it cannot execute. It creates a proposal for human review.
    return proposals.create(Proposal.pending(action, investigation.reasoning()));
}
 
// Executed only from an authenticated human approval, never by the agent.
public Result approve(String proposalId, String approverId) {
    Proposal proposal = proposals.require(proposalId);
    validateApproval(proposal, approverId);   // status, staleness, authority
    return executor.execute(proposal.action());
}

The agent's reasoning travels with the proposal so the human can approve in seconds rather than re-investigating. The DevAgentic project builds this gate in full.

What needs a human

Gate on the cost of being wrong, not the difficulty:

ActionNeeds approval?
Search, look up, calculateNo — read-only
Draft an emailNo — reversible (it is not sent)
Send an emailYes — external and irreversible
Move money, issue a refundYes — irreversible, high impact
Delete dataYes — irreversible
Deploy codeYes — high impact

Confidence thresholds

Route by confidence: automate the confident cases, escalate the uncertain ones.

Confidence-based routing
public Outcome handle(Request request) {
    Decision decision = agent.decide(request);
 
    if (decision.confidence() >= AUTO_THRESHOLD && decision.isReversible()) {
        return executor.execute(decision);        // confident + safe → automatic
    }
    if (decision.confidence() >= REVIEW_THRESHOLD) {
        return humanQueue.enqueueForApproval(decision);   // uncertain → review
    }
    return humanQueue.enqueueForHandling(request);         // low → human handles fully
}

Confidence can come from the model's own estimate, from agreement across multiple attempts (self-consistency), or from business rules ("refunds over £500 always go to a human").

Escalation patterns

When the agent cannot or should not proceed, escalate with context:

public Handling route(Request request) {
    AgentAttempt attempt = agent.attempt(request);
 
    return switch (attempt.status()) {
        case SOLVED -> Handling.resolved(attempt.result());
        // Escalate WITH the work done, so the human continues rather than restarts.
        case NEEDS_APPROVAL -> Handling.escalate(attempt.proposal(), attempt.reasoning());
        case OUT_OF_SCOPE -> Handling.escalate(request, attempt.whyStuck());
        case LOW_CONFIDENCE -> Handling.escalate(request, attempt.alternatives());
    };
}

The escalation must carry what the agent found. A handoff that dumps the raw request back on a human, discarding the investigation, wastes the automation entirely.

Feedback loops

Human decisions are training signal. Capture them:

public void recordDecision(String proposalId, ApprovalDecision decision) {
    // When a human overrides the agent, that is a labelled example of where the
    // agent was wrong. Feed it into your evaluation set and, over time, into
    // tuning the confidence thresholds and prompts.
    feedbackStore.record(proposalId, decision);
    if (decision.wasOverride()) {
        evaluationSet.addCase(proposalId, decision.correctOutcome());
    }
}

Over time, the pattern of overrides tells you where the agent is weak and where you can safely raise the automation threshold. See agent evaluation & testing.

Designing the human's experience

HITL fails if the human's job is tedious. A good approval interface shows: the proposed action, the agent's reasoning, the evidence, and one-click approve/reject/modify. If reviewing a proposal takes as long as doing the task, you have automated nothing. The agent's job is to make the human's decision fast and well-informed.

Next

Frequently Asked Questions

What is a human-in-the-loop AI system?
A system where a human reviews or approves the AI's decisions before they take effect, especially for consequential actions. It lets you deploy useful autonomy while keeping a person accountable for outcomes — the agent proposes, gathers information and drafts actions, and a human approves the ones that matter.
Which agent actions need human approval?
Anything irreversible or high-impact: sending external communications, moving money, deleting data, deploying code, making commitments on the organisation's behalf. Read-only actions and low-stakes reversible ones can run autonomously. The dividing line is the cost of being wrong, not the difficulty of the task.
How do confidence thresholds work in HITL?
The system routes low-confidence decisions to a human and handles high-confidence ones automatically. Confidence can come from the model, from agreement between multiple attempts, or from business rules. The threshold trades autonomy against safety — set it where the cost of an automated error crosses the cost of human review.
Does human-in-the-loop defeat the point of automation?
No, if designed well. The agent still does the heavy lifting — investigating, drafting, gathering context — and the human only makes the final call on consequential actions, which is fast when the agent presents a clear proposal with its reasoning. You automate the work and keep human judgement where the stakes require it.

Related tutorials