Human-in-the-loop approval workflows

Drag the threshold up from zero. At 0, every action — even listing files in /tmp — gets flagged for a human, which defeats the point of having an autonomous agent at all. Somewhere in the middle, the flags thin out to exactly the one action that actually deserves attention.

Each action in a trajectory carries a fixed risk score. A gate flags an action for approval exactly when its risk clears a chosen threshold $\tau$ — everything else runs on its own, no human involved.

• $a$ — one action in the agent's trajectory.
• risk($a$) — a fixed 0–10 score for that action (here: 1, 2, 3, 9, 1 across the 5 steps).
• $\tau$ — the approval threshold: the one knob a human operator actually sets.
• needsApproval — 1 (flagged, wait for a human) or 0 (safe, runs immediately).

1. τ too low floods every action to a human

   At $\tau = 0$, risk $\ge 0$ holds for all five actions — even "list files in /tmp" waits on approval. Autonomy is gone.

2. τ too high lets the dangerous action through unreviewed

   At $\tau = 10$, nothing clears the bar — not even the risk-9 refund. The gate exists and catches nothing.

3. The four safe actions top out at risk 3

   Steps 1, 2, 3, 5 have risk 1, 2, 3, 1. The highest of those four is 3 — that's the ceiling any correct threshold has to clear.

4. Any τ strictly above 3 and at most 9 isolates exactly step 4

   $\tau \in \{4, 5, 6, 7, 8, 9\}$ flags risk $\ge \tau$ only for the refund's risk of 9, and nothing with risk $\le 3$.

flagged steps = [4] — correctly isolates the risky step

Watch the flagged-steps readout as you drag $\tau$ up from 0. It starts at "[1, 2, 3, 4, 5]", thins through intermediate mixes, locks onto "[4]" alone for a wide band of thresholds, then finally empties out to "[]" once $\tau$ passes 9.

Walk five threshold choices against the fixed trajectory:

1. τ = 0 flags everything

   All five risks (1, 2, 3, 9, 1) are $\ge 0$. Flagged = [1, 2, 3, 4, 5]. Not a clean split.

2. τ = 3 still catches an innocent action

   Risk 3 (step 3, "post a status update") is $\ge 3$, so it gets flagged right alongside step 4. Flagged = [3, 4]. Still not clean — the threshold sits exactly on a safe action's own score, not above it.

3. τ = 4 is the smallest threshold that isolates step 4

   Now only risk $\ge 4$ qualifies, and only step 4's risk of 9 clears it. Flagged = [4]. Clean.

4. τ = 9 is the largest threshold that still catches it

   Risk $\ge 9$ still includes step 4, exactly at its own score. Flagged = [4]. Still clean.

5. τ = 10 misses it entirely

   No action has risk $\ge 10$. Flagged = []. The refund now runs with no human in the loop at all.