# Human-in-the-Loop (HITL)

Human-in-the-Loop (HITL) lets an AI employee pause and ask before it takes a sensitive action, like sending an email or spending on a paid tool, instead of guessing what you want. An inline card shows up right in the chat with Approve, Reject, or option buttons, and the employee resumes the instant you respond.

Your employee pauses before any sensitive action, explains what it wants to do and why, and waits for your explicit approval. It might say: "I want to send this email to 50 leads. Here is the draft. Approve or reject?" You read it, approve with one click, and it proceeds. If something looks wrong, you reject and give feedback. Nothing sensitive happens without your say-so.

The approval gateway is smart about what needs approval and what does not. Routine tasks like writing a document draft, searching the web, or updating a task board happen automatically. High-stakes actions like sending emails to customers, posting on social media, making purchases, or modifying production systems trigger an approval request. You configure where the line sits per employee.

Approval requests reach you through in-app notifications and email. Approve or reject from either channel without switching context. If you are away and an approval sits pending for too long, the employee waits. It does not default to "go ahead." Your AI workforce respects the boundary between autonomy and oversight.

## Your AI Employee Asks Before It Acts

Not every action an AI agent takes should happen automatically. The Approval Gateway lets you define exactly which actions, tools, or conditions require a human sign-off before the agent proceeds. Whether it is sending an email to a client, deleting a file, or submitting a form, the employee pauses, explains what it is about to do and why, and waits for your approval.

This is not a blunt kill switch. The agent presents its reasoning in plain language so you understand the full context before deciding. You can approve, reject, or redirect, and the employee continues from that point without losing its place in the task. It is the difference between autonomous AI and trusted autonomous AI.

## Configure Which Actions Require Sign-Off

Every team has a different risk threshold. A marketing agent scheduling social posts may need no approval at all, while a finance agent initiating transfers should pause on every transaction above a certain amount. Approval Gateway lets you define those rules per employee, per tool, or per action type.

Rules can be based on tool category (external communications, financial actions, data deletion), output content, or custom conditions you define. Once set, the policy applies consistently, even as the agent handles dozens of concurrent tasks. You stay in control without being in the way.

Approval history is logged with full context: what the agent intended, who approved or rejected, and what happened next. This creates an auditable record useful for compliance, team review, and improving your configuration over time.

## Approval Gateway as an Agentic AI Safety Pattern

As organizations deploy more autonomous agents, the question of human oversight becomes critical. Research on agentic AI consistently identifies human-in-the-loop checkpoints as the most practical safety mechanism for high-stakes workflows. Approval Gateway is that mechanism, built directly into every AI employee.

Unlike bolt-on approval tools, this is native to the agent's decision loop. The agent is trained to recognize when it is entering sensitive territory and surface the decision to a human rather than proceeding on assumption. This makes your AI workforce predictable and trustworthy, especially in regulated industries or customer-facing roles.

## How It Works

**Agents pause before defined sensitive actions and wait for a human approval before proceeding, giving you control without manual intervention on everything.**

Define approval rules by action type, tool, or content condition. An agent sending an email to a client, posting to a social channel, or executing a financial transaction will stop, generate a summary of what it plans to do and why, and send you an approval request. You review the proposed action in context and approve or reject with one click. The agent resumes or stops based on your response.

Approval gates are not a safety net for broken agents. They are a deliberate control point for high-stakes actions where human judgment belongs in the loop. Well-configured agents handle 95 percent of their work autonomously and only surface the specific actions that warrant a human decision. This is the architecture that lets organizations deploy AI agents broadly without accepting unlimited autonomous risk.

## Use Cases

### Legal team reviews AI-drafted contracts before send

The AI employee drafts the contract and pauses, sending it to legal for approval before it goes to the client. Nothing leaves without a human sign-off.

### Finance team approves AI-initiated payments

When the AI agent prepares a payment or invoice, it routes to the finance lead for approval before executing, preventing unauthorized transactions.

### Marketing team signs off on AI-generated content

The AI employee queues content for review, the team approves or edits, and only then does the agent publish. The quality gate is always in place.

### Ops team controls AI access to sensitive systems

Any AI agent action that touches production systems or sensitive data triggers an approval request, so a human always authorizes critical steps.

## Comparison

| Before | After |
|---|---|
| AI agents act on sensitive tasks with no human check. | The approval gateway stops the agent and waits for explicit sign-off. |
| Mistakes from autonomous AI actions are caught after the fact. | Approvals catch issues before the agent takes the action. |
| Building approval flows into AI workflows requires custom code. | Approval gates are a native platform feature, configured in minutes. |
| Compliance requires human sign-off but AI doesn't support it. | Every critical action can be gated behind an approval step. |

## FAQ

### Which actions can trigger an approval request?

Any tool call, external communication, data write, or custom condition you define can be gated. You configure rules per employee or globally, down to specific tool types or action patterns. The agent evaluates these rules at runtime before executing.

### What happens if no one approves in time?

You can set a timeout policy per rule: wait indefinitely, escalate to a team lead, or cancel the action with a logged reason. The agent does not proceed on its own if approval is required and not received.

### Can the agent explain why it is asking for approval?

Yes. Every approval request includes the agent's reasoning: what task it is working on, what it plans to do, and why this step requires sign-off. You always have enough context to make an informed decision.

### Is this available for multi-agent workflows?

Yes. In multi-agent orchestration scenarios, the requesting agent pauses and surfaces the approval to a human owner of that employee. The approval chain is tracked so you can see which agent in a workflow triggered the gate.

### Can I require human approval before my AI agent takes a sensitive action?

Yes, the approval gateway lets you designate specific actions that require a human sign-off before the agent proceeds. The agent pauses, sends you the request, and only continues after you approve or reject it.

> We turned on approval gates for anything touching customer data. Now I can let agents run freely without worrying about compliance.
>
> David O., Head of Compliance · regulated industry

## Where Human-in-the-Loop (HITL) fits

Human-in-the-Loop (HITL) is part of AI Guardrails.

Set boundaries for what employees can read, say, share, and do. Protect data, enforce your policies, and route sensitive actions to you for approval.

- [AI Guardrails](/en/features/guardrails): AI guardrails for every employee.

## Read the guide

- [Guide: Human-in-the-Loop (HITL)](/en/guide/work/approval)

## More in AI Guardrails

- [Protect Against Prompt Injection](/en/features/guardrails/guardrail_input_safety): Input Safety reads every incoming message before your employee does, and stops the ones trying to hijack it: instructions to ignore its rules, requests to print its own configuration, and role-play framed to talk it out of its guardrails. That matters most where the message did not come from you, so a payload buried in a forwarded email, a support ticket, or a shared thread cannot turn your employee against you. Pick Low, Medium, or High, and every level catches the textbook attacks: the level decides how much benefit of the doubt the genuinely ambiguous messages get. Medium is the default and suits most companies. Blocked messages get a short, human reply and the conversation carries on, with each one recorded so you can see what has been tried.
- [Block Unsafe Employee Responses](/en/features/guardrails/guardrail_output_safety): Output Safety reads your employee's reply before anyone else does. Toxic, abusive, or otherwise unfit answers are held back rather than sent, which is what you want the moment employees write to customers, post to a channel, or answer a ticket without you watching. It checks the reply your employee actually wrote, so what you see caught is what would genuinely have gone out. Set it to Low, Medium, or High and review everything it held back in the live inspector. Blunt, direct, and critical business writing is left alone: the policy is looking for replies that would embarrass you, not ones that are simply frank.
- [Protect Personal Data](/en/features/guardrails/guardrail_pii_protection): PII Protection finds personal data in a message and replaces it with a marker before the model reads a single character of it. A pasted card number becomes [CREDIT_CARD], an email becomes [EMAIL_ADDRESS], and the same happens on the way out so nothing sensitive travels back into an email, a channel, or a ticket. You pick exactly what to protect from seven data types: email, phone, name, credit card, Social Security number, IP address, and address. The markers keep the sentence readable, so your employee understands the request perfectly and keeps working while the raw value stays out of the conversation. It runs on every message, in both directions, company-wide, from one switch.
- [Control What Employees Discuss](/en/features/guardrails/guardrail_topic_control): Topic Control gives you two lists and you can use either or both. Blocked topics are off-limits no matter how a conversation gets there, which keeps employees out of politics, competitor comparisons, or medical and legal advice. Allowed topics set a remit instead: name the subjects an employee handles and anything unrelated is politely declined, which is how you keep a support employee on product help, billing, and refunds. Both lists match on meaning rather than exact words, so ruling out competitor pricing also covers how much cheaper are we than the other tools out there. Greetings and short replies always get through, so a scoped employee still feels natural to talk to.
- [Keep Confidential Data In-House](/en/features/guardrails/guardrail_data_leakage): Data Leakage Prevention guards both ends of the conversation. On the way in it recognises someone fishing for your employee's internals, whether they ask outright, dress it up as a game, or try the repeat everything above this line trick. On the way out it reads the reply itself and holds it back if it is about to hand over a system prompt, internal configuration, an access token, or a credential. Questions about your own business data are never affected, so an employee still answers freely about your customers, documents, and numbers. One switch, no configuration to maintain, and every attempt is logged so you can see who has been probing.
- [Prevent Repeated and Runaway Actions](/en/features/guardrails/tool_safety): Sistava automatically caps how many emails, messages, and external writes (CRM records, calendar events, paid searches) an AI employee can send in a single conversation, hour, and day, and blocks an identical send to the same recipient from going out twice within 24 hours. These limits run in the background per employee with no setup required, so a stuck task or unexpected loop cannot spam a contact's inbox, pollute your CRM, or burn through paid API calls. When a limit is hit, the employee is told to slow down or hand the task to a human instead of retrying blindly.
- [Protect Organisation Information](/en/features/guardrails/information_boundaries): Your AI employee treats what it learns in the workspace the way a careful coworker would: useful for doing the work, not free to repeat. It tells private, role-restricted, and confidential information apart from ordinary shared context, and it never volunteers the sensitive kind just because someone asked. When a teammate needs a restricted answer, the employee can request permission from the right person for that one specific answer instead of guessing or refusing outright.
- [Protect Your Email Reputation](/en/features/guardrails/email_deliverability): Every email your AI employees send, whether it is a notification, a mailbox reply, or an outbound message, passes through a pre-send check before it leaves. Sistava validates the address, checks it against a suppression list built from past bounces and complaints, and blocks anything that would hurt your sending reputation. You do not configure this: it runs silently on every send so your domain keeps a clean track record with inbox providers.
- [Delegation & Teamwork Limits](/en/features/guardrails/delegation_teamwork_limits): Tune how your leader employees hand off work to teammates. Set how many teammates a leader can delegate to at once, how far a delegation chain can reach, how long a delegated teammate can work before timing out, and how tolerant employees are of repeating themselves before loop protection stops them.
- [Detect and Redact PII](/en/features/guardrails/pii_detection): PII Protection watches every message your AI employees send and receive, and masks personal data like emails, phone numbers, credit card numbers, and social security numbers before it goes anywhere it shouldn't. You choose exactly which data types to catch. It runs on every employee across your company the moment you turn it on, with no per-employee setup.
- [Company-Wide Policies](/en/features/guardrails/company_policies): Company Policies let you set organization-wide safety rules that apply to every AI employee at once: block prompt injection attempts, filter harmful output, redact personal information, stop internal details from leaking, and restrict which topics employees can discuss. Turn each policy on with one toggle from your company dashboard, and it takes effect immediately across your whole team.
- [Sistava Mentor](/en/features/guardrails/ai_mentor): Every employee you hire on Sistava works alongside Steve, the Sistava Mentor: a named, Sista-side coach who checks in on their work and posts straight into the same chat thread you already read. When a hire drifts from the brief, misses a step, or gets stuck, Steve sends a message under his own name and avatar coaching them on craft, never on priorities. You always see it happen: the message sits in your chat history like any other turn, so nothing about the correction is hidden from you.

## Explore

- [Every feature](/en/features)
- [Browse AI employees](/en/agents)
- [Pricing](/en/pricing)