Skip to main content

Overview

HITL (Human in the Loop) ensures the AI Agent obtains human confirmation before executing sensitive operations. Zeus provides Auto-Run modes and tool approval workflows, allowing users to flexibly control the Agent’s level of automation.

Auto-Run Mode

Auto-Run mode controls the level of automation when the AI Agent executes tools.

Three Modes

ModeDescriptionUse Case
Run EverythingAutomatically execute all toolsHigh trust, simple tasks
Use AllowlistOnly auto-execute allowlisted toolsPartial trust
Ask EverytimeAsk the user every timeSensitive operations

Tool Approval UI

When a tool requires approval, the frontend displays an approval card containing the tool name, parameters, current status (pending / approved / rejected / running / completed), and approve/reject buttons.

Approval Decision Logic

Approval decisions are based on the current Auto-Run mode:
  • Run Everything: All tools execute automatically, no approval needed
  • Use Allowlist: Only allowlisted tools execute automatically; other tools require approval
  • Ask Everytime: All tools require user approval

Data Persistence

User Auto-Run mode settings and tool allowlists are persisted via the database. Each user has independent configuration. The allowlist has a unique constraint on user and tool name to prevent duplicates.

Trigger Conditions

HITL approval is triggered under the following conditions:
  1. The tool is not in the allowlist
  2. Auto-Run mode is “Ask Everytime”
  3. The tool is marked as requiring confirmation

Interaction Flow


Interruption & Recovery

When a tool requires approval, the Agent’s execution is suspended and the state is persisted via the Checkpointer. After user approval, the Agent resumes execution from the breakpoint. User approval decision types:
DecisionBehavior
approvedExecute tool (optionally with modified parameters)
rejectedSkip execution; Agent receives rejection reason and will not retry
modifiedExecute with modified parameters (legacy compatibility)
timeoutAutomatic skip on timeout
Rejected tools have a system message appended, explicitly telling the Agent not to retry that tool. For more technical details on interrupt recovery, see the Agent Loop and Runtime documentation.