Building Real Human-in-the-Loop Controls for AI Coding Agents

Wrapping a coding agent in constant approval prompts feels like oversight but often isn't. Studies show that when humans get a mid-task chance to intervene, they actually catch and stop harmful actions only 9-26% of the time — they scroll past diffs and rubber-stamp. The fix is to grade every action an agent can take by reversibility, blast radius, and stakes (G0 trivial through G3 critical) and match a control to each grade: reads run freely and get logged, code edits and sandboxed tests are notify-and-undoable, merges to main and risky installs require a genuine review with a separate approver, and truly high-stakes actions — destructive shell commands, untrusted dependency installs, production deploys — get prevented outright rather than gated behind a prompt.

The key insight is that checkpoint and undo features, which most agents ship, only cover structured file edits made through editing tools. Shell-level operations like rm, mv, or cp sit entirely outside that undo boundary, which is exactly why they're the most dangerous and the least catchable by a human glancing at a prompt. Practical mitigations include running the agent sandboxed by default with no network egress and scoped, short-lived credentials; enforcing maker-checker separation so an agent never approves its own merge or deploy; and routing any real deletion through a narrow, reversible operation instead of a raw shell call. This same design also neutralizes the 'lethal trifecta' risk where an agent simultaneously holds access to secrets, exposure to untrusted content, and a network path out — a combination no approval prompt can catch because the malicious instruction is buried where no human will read it.

For engineering teams, the practical takeaway is to reserve approval prompts for the narrow band where a human can genuinely evaluate and stop a problem, and design prevention into everything else.