An agent should escalate to a human the moment an action becomes hard to reverse, expensive to get wrong, or something the agent is no longer confident about. Everything else it can run on its own. The design work is in drawing those three lines precisely, wiring the handoff so the human receives full context, and logging every decision so you can prove later who was accountable. Get this right and autonomy becomes a dial you turn up as evidence accumulates, rather than a switch you flip and hope.
This matters because the failure mode is common. Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls (Gartner, 25 June 2025). Weak handoff design sits under most of that third category.
Autonomous, controlled, or supervised: what are you actually choosing between?
Treat autonomy as a spectrum with three practical settings, decided per action rather than per agent.
Fully autonomous means the agent acts and the human sees the result afterward, if at all. Good for read-only or trivially reversible work: fetching a record, drafting a summary, tagging a ticket, checking availability.
Controlled, or human-in-the-loop, means the agent proposes and a human approves before the action commits. This is the setting for anything with real consequences: issuing a refund, editing a clinical record, sending an external communication under a regulated brand.
Supervised, or human-on-the-loop, means the agent acts autonomously but a human monitors a live queue and can interrupt. This suits high-volume flows where blocking on approval would defeat the purpose, and where a fast override is enough of a safety net.
The point of naming the three settings is that most teams default the whole system to one of them. A single agent almost always needs all three, assigned action by action.
When should an agent escalate to a human?
Four triggers cover the vast majority of real cases. Encode them explicitly.
Confidence below threshold. When the model's own confidence, a retrieval score, or a verification check falls under a line you set, the agent hands off. Confidence gating is the highest-value trigger, because it catches the situations the agent itself has flagged as shaky.
Irreversibility. Score every action the agent can take on how hard it is to undo. Reading data is reversible. Sending money, deleting records, and dispatching a message to a patient are not. Anything above your reversibility line routes through approval regardless of confidence.
Value or blast radius. A refund of two hundred rupees and a refund of two lakh differ only in a number, and the agent should treat them differently. Set thresholds on monetary value, number of records touched, and number of people affected.
Policy and compliance. Some actions require a human by rule, independent of confidence or cost. Under the DPDP Act 2023, processing that carries meaningful risk to a data principal deserves a human check, and clinical actions touching a patient record sit inside NMC and ABDM expectations that assume an accountable practitioner. Encode these as hard gates the agent cannot bypass.
A useful sanity check: Gartner forecasts that agentic AI will autonomously resolve 80% of common customer service issues without human intervention by 2029 (Gartner, 5 March 2025). Read that as guidance on where the line sits. The common, low-stakes 80% is where autonomy earns its keep. The remaining 20% is exactly the set your triggers should catch.
How do I design the human-in-the-loop mechanics?
Deciding to escalate is the easy half. The handoff itself is where most designs quietly fail.
Pass the full context, rather than a ping. A human pulled in at 3pm between two other tasks needs the agent's proposed action, the reasoning behind it, the inputs it used, the confidence scores, and the specific reason for escalation. A bare "needs review" notification forces the reviewer to reconstruct the case from scratch, which is slow and error-prone. The handoff payload is a first-class design artifact.
Make the response structured. The human should approve, reject, or edit-then-approve, and every rejection should capture a reason code. Those reason codes become your training signal for where the agent is weak and where a threshold needs moving.
Set a timeout and a default. Every escalation needs an answer for what happens if no human responds in time. For reversible actions the default can be to proceed. For irreversible ones the default is to hold and alert. Deciding this in advance stops the system from stalling silently.
Keep the reviewer's cognitive load honest. If your thresholds escalate 60% of actions, humans will start rubber-stamping and your safety net becomes theatre. Tune triggers so the queue stays small enough to review with genuine attention. An approval a reviewer does not actually read is worse than no approval, because it manufactures a false record of oversight.
Log everything, immutably. Who saw what, when, what they decided, and on what evidence. In regulated industries this audit trail is the difference between a defensible deployment and an indefensible one. It is also how you learn: the log is the dataset that tells you which gates to loosen.
How do I move an action from controlled to autonomous over time?
Autonomy should be earned with evidence, and the log is the evidence. Start a new action class in controlled mode. Track how often humans approve the agent's proposal unchanged. When agreement on a given action class stays high across a large enough sample, promote that class from controlled to supervised, then review whether it can go fully autonomous. If agreement drops, demote it. This compounding loop is the whole game: the system widens its own autonomy as it proves itself, and every widening is backed by numbers you can show a regulator or a board.
The direction of travel is real. Gartner estimates at least 15% of day-to-day work decisions will be made autonomously through agentic AI by 2028, up from 0% in 2024 (Gartner, 25 June 2025). Teams that instrument the handoff now will be the ones able to expand autonomy safely as that curve steepens.
What does this look like in a regulated deployment?
In the voice-first customer experience agents Nextdot runs at Narayana Health and Gleneagles, the same logic governs where the agent acts and where it hands to a human. Routine, reversible interactions run autonomously. Anything touching a clinical decision, a patient record, or an irreversible commitment routes to a person with full context attached, and every handoff is logged for audit. The autonomy dial moves outward only as the agreement data justifies it. That discipline, rather than raw model capability, is what makes an agentic system safe to run in a hospital.
Frequently asked questions
What is the difference between human-in-the-loop and human-on-the-loop?
Human-in-the-loop means a person approves each action before it commits, so the agent proposes and waits. Human-on-the-loop means the agent acts autonomously while a person monitors and can interrupt. Use in-the-loop for irreversible or high-value actions and on-the-loop for high-volume flows where a fast override is sufficient.
How do I set a confidence threshold for escalation?
Start conservative and measure. Pick a threshold, run in controlled mode, and track how often the agent's proposals above that line are approved unchanged. Move the line based on that agreement rate rather than intuition. Different action classes warrant different thresholds.
Will too many escalations break the system?
Yes, in two ways. It erodes the efficiency that justified the agent, and it pushes reviewers toward rubber-stamping, which turns oversight into theatre. If your escalation rate is high, tighten which actions truly need a human rather than escalating everything.
How does human-in-the-loop relate to DPDP and clinical compliance?
The DPDP Act 2023 and NMC and ABDM expectations assume an accountable human stands behind consequential decisions about a person or a patient. Encode those as hard gates the agent cannot bypass, and keep an immutable log of every human decision so the deployment is defensible under audit.
Can an agent become more autonomous over time?
Yes, and it should, once it earns it. Track approval agreement per action class, promote classes that stay reliable across a meaningful sample from controlled to supervised to autonomous, and demote any class where agreement slips.