Human in the loop AI with Claude: approvals, handoffs and review that scales

Human in the loop means a person stays in charge at the moments that matter, not that a person watches everything. With Claude agents there are four places to put the human: approving risky actions before they run, answering the agent's clarifying questions, taking over a case the agent should not decide, and reviewing a sample of outputs afterwards. Hard limits still belong in code.

What human in the loop means for AI agents

An agent that asks permission for everything is useless, and one that never asks is dangerous. Human in the loop is the design work in between: deciding where a person enters and what they decide there.

1. Approve risky actions before they run

In Claude Code, Manual mode asks before edits and commands, and an ask rule such as Bash(git push *) forces a prompt even when other rules would allow the call; see Claude Code permissions. MCP server authors can mark a tool so it requires explicit approval on every call.

In the Agent SDK, a canUseTool callback pauses the agent whenever a tool call needs approval. Your app shows the request and returns one of:

• allow, optionally with a modified input (for example, scoping a path);
• deny with a message, which Claude reads and uses to change course.

Two details matter in production. The callback never fires for tools already approved by a rule or a mode such as acceptEdits, so logic that must run on every call belongs in a PreToolUse hook. And the callback can wait indefinitely: if a person may take hours, have a hook return defer so the process can exit and the session resume later.

2. Let the agent ask

When a task has several valid paths, Claude can call AskUserQuestion with one to four multiple-choice questions; your callback shows them and returns the choices. It is common in plan mode, where Claude gathers requirements before proposing changes. One limit today: subagents spawned through the Agent tool can't use it.

3. Hand off to a person at the right moment

A support agent should hand a case to a human when:

• the customer asks for a person: honor it immediately, without first insisting on investigating;
• the policy is silent or the request needs an exception;
• the agent cannot make meaningful progress;
• the action is high-stakes, such as a safety report or a refund above a limit.

Two common triggers are unreliable: the customer's tone, and the model's own confidence score. Neither tracks how hard the case actually is. When a lookup returns several matching customers, the right move is to ask for another identifier, not to pick one.

The hand-off itself should carry a short summary (who, what was asked, what the tools confirmed, what was tried) so the person doesn't start from zero. More on structuring that in multi-agent systems, where the same rule applies between agents.

4. Review outputs afterwards, at scale

For pipelines such as document extraction, the loop closes after the fact:

1. Measure by segment. An overall 95% can hide one document type at 70%. Check accuracy per document type and per field before reducing review.
2. Route the uncertain. Send low-confidence fields and contradictory sources to people first; their time is the scarce resource.
3. Keep sampling the confident. A stratified random sample of high-confidence outputs keeps measuring the error rate and catches new error patterns.
4. Calibrate. Confidence scores only help routing once they have been checked against a labeled set.

Grounding helps reviewers too: outputs that cite the source for each claim are faster to check, as covered in LLM hallucination.

Humans for judgment, code for hard limits

A person in the loop is for decisions that need judgment. A rule that must never be broken (a refund ceiling, a forbidden path) should not depend on someone clicking the right button: enforce it with a hook or a deny rule, and use the human for what is left.

Human in the loop on the Claude Certified Architect exam

Domain 5 of the CCAR-F exam covers this directly: task 5.2 (escalation triggers, honoring requests for a human, asking for identifiers instead of guessing, why sentiment and self-reported confidence are poor proxies) and task 5.5 (accuracy by segment, stratified sampling, calibrated confidence for routing review).

More in all articles.

Sources: Handle approvals and user input (Agent SDK); Configure permissions; Claude Code MCP (tools that require approval); Claude Certified Architect Foundations exam guide v1.0, task statements 5.2 and 5.5.

FAQ

What is human in the loop AI?

A design where a person approves, decides or reviews at defined points of an AI workflow, so the system acts autonomously on routine work and defers to a human on risky, ambiguous or high-stakes steps.

How do I add human approval to a Claude agent?

In Claude Code, use ask rules or Manual mode. In the Agent SDK, pass a canUseTool callback: it pauses the agent when a tool needs approval and lets you allow, deny, or allow with a modified input.

When should an AI agent hand off to a human?

When the customer asks for a person, when policy is silent or needs an exception, when the agent can't make progress, or when an action is high-stakes. Sentiment and the model's self-reported confidence are unreliable triggers.

How much human review does an AI extraction pipeline need?

Measure accuracy per document type and field, not only overall; route low-confidence and contradictory cases to people; and keep a stratified random sample of high-confidence outputs under review to catch new error patterns.