Skip to primary content
Esaholic
Governance Gate Architecture

Human-in-the-Loop Systems Services

Reviewed by Umar Abbas • CTO & Principal AI Architect

Human-in-the-loop (HITL) systems are governance architectures that pause autonomous agent workflows at critical decision nodes, requiring explicit human authorization before executing financial, legal, or high-risk actions. We engineer interruptible state machines using LangGraph and webhook-driven approval channels in Slack and Teams.

Compliance Record0 Violations
Notification channelSlack & Teams
State StoragePostgres Thread
Auth StandardOAuth 2.0 / SSO
Security Perimeter

HITL Authorization Gate Boundary

Human Authorization Security Perimeter

Secure Customer Perimeter (VPC / On-Prem) Zero Data Egress Zone
Agent State Graph Engine inside

Pauses execution on high-risk task payload

HITL Webhook Gate boundary

Dispatches approval payload to Slack/Teams

External Foundation Endpoint Stateless Call
Authorized Human Operator Stateless API

Reviews diff & clicks Approve/Reject

Text alternative for screen readers & search engines
  • Agent State Graph Engine (inside security perimeter): Pauses execution on high-risk task payload
  • HITL Webhook Gate (boundary security perimeter): Dispatches approval payload to Slack/Teams
  • Authorized Human Operator (outside security perimeter): Reviews diff & clicks Approve/Reject
Interruptible Graph Code

LangGraph Interruptible Node Definition

from langgraph.graph import StateGraph
from langgraph.checkpoint.postgres import PostgresSaver

builder = StateGraph(dict)

def high_risk_action_node(state: dict):
  # This node requires explicit approval payload
  return {"status": "EXECUTED_ACTION"}

builder.add_node("action_node", high_risk_action_node)

# Compile graph with interrupt before high risk node
graph = builder.compile(
  checkpointer=PostgresSaver(conn),
  interrupt_before=["action_node"]
)
System Architecture

Four-Layer HITL Governance Stack

Human-in-the-Loop Infrastructure

Layered Stack Architecture
L4
Notification UI Channel
(Core System Layer)

Interactive Slack cards, Teams cards, and custom portal dashboards

L3
Identity & SSO Verification
(Core System Layer)

OAuth 2.0 callback verification matching employee SAML roles

L2
Interruptible State Graph
(Core System Layer)

LangGraph checkpointer pausing workflow execution

L1
Audit & Compliance Log
(Core System Layer)

Immutable PostgreSQL ledger recording human approval signatures

Architectural Layer Stack
Text alternative for screen readers & search engines
  • Layer 4: Notification UI Channel (Core System Layer) — Interactive Slack cards, Teams cards, and custom portal dashboards
  • Layer 3: Identity & SSO Verification (Core System Layer) — OAuth 2.0 callback verification matching employee SAML roles
  • Layer 2: Interruptible State Graph (Core System Layer) — LangGraph checkpointer pausing workflow execution
  • Layer 1: Audit & Compliance Log (Core System Layer) — Immutable PostgreSQL ledger recording human approval signatures
Governance Telemetry

820,000 Workflow Runs Benchmark

Evaluated ParameterMeasured Telemetry
Unauthorized High-Risk Actions0 Violations
Median Human Review Response4min 15sec
Audit Trail Logging100% Immutable Signatures
Buyer FAQ

Frequently Asked Questions

What happens to the agent state while waiting for human approval?↓

The agent graph pauses and serializes its state into PostgreSQL. When a human clicks approve in Slack or Teams, execution resumes seamlessly.

Can we set timeout limits on human approval requests?↓

Yes. We configure configurable timeout windows (e.g. 24 hours). If unapproved, the state graph auto-cancels or routes to an escalation queue.

How do HITL gates prevent unauthorized approval spoofing?↓

We authenticate webhook callbacks using OAuth 2.0 user tokens and verify approval signatures against corporate SAML/SSO identities.

How long does a HITL governance gate setup take?↓

HITL checkpoint integration takes 3 to 5 weeks, including Slack/Teams app setup, state persistence, and audit logging.

Who owns the authorization middleware code?↓

Your organization owns 100% of all callback webhooks, authorization logic, and notification templates.

Implement Human Governance Gates for AI Agents

Consult with CTO Umar Abbas to build secure human authorization checkpoints.

Request Governance Review