25 July 2026 · 3 min read

“Human in the loop” is two mechanisms

I built an approval queue for my agents in February. In June I connected the same system to Claude over MCP, and the queue was the wrong tool for it.

Not broken. Wrong.

Both are “human in the loop.” They are not the same mechanism, and a system that moves money needs both.

Flow diagram. An agent wants an irreversible action. A decision asks: is a human watching? No routes to a durable queue a person clears later. Yes routes to a refusal that mints a token bound to a fingerprint of the arguments, redeemed within 300 seconds. Both converge on the action executing.

Case 1. Nobody is watching.

An agent runs on a schedule overnight and decides to commit a purchase order. No chat, no session, no human anywhere. So the action goes into a durable queue and waits. That is real approval. The work stops until a person says yes.

Case 2. A human is already there.

Someone is in a chat, asking the agent to do things. A blocking queue here is absurd. You would be blocking a present human on themselves.

So the tool refuses the first call instead, and hands back a short-lived token bound to a fingerprint of the exact arguments. Call it again with the same arguments and it runs. Change one digit and the token is void. It expires after 300 seconds.

Nobody approved anything there. The human is on the loop, not in it.

What the token actually buys is argument integrity, and a guarantee that nothing executes against a world more than 5 minutes stale.

Python code from mcp/guardrails.py. CONFIRM_TTL_SECONDS is 300. A _fingerprint function SHA-256 hashes the tool name, user id and payload. _mint embeds that hash in a signed JWT. _check raises an error if the hash no longer matches the arguments at execution time.

Swap the two and both collapse.

Give the unattended agent a confirmation token and it just echoes its own token back. It confirms itself. The gate becomes decoration.

The other thing I would tell anyone building this: the system never judges whether an action is dangerous. It checks a list. 34 tools are classified high risk. Anything that mutates data and nobody thought to classify fails closed and needs approval anyway.

Boring beats clever when the thing being gated is money.