Human-in-the-Loop, In Practice: How a Person Takes Over From the Agent

Oversight is not an approval queue

The usual pitch for human-in-the-loop is a dashboard of pending approvals with priority badges and a timer that approves whatever nobody looked at. That solves a back-office problem: an agent about to write to a system of record.

An agent answering your customers fails differently. It does not know something, or the person on the other end is annoyed, and every additional turn it takes makes the situation worse. The useful control is not "approve this action". It is "stop talking, a person is here now".

So that is what we built. Here is each moving part, and what it does not do.

Escalation is a tool, not an instruction

Each agent has escalation triggers you choose: hand over when the agent cannot answer, hand over when the customer asks for a person or is upset, or neither.

The part worth knowing is how "neither" is enforced. Turning escalation off does not add a polite line to the prompt asking the model to refrain. It removes the tool. There is nothing to call, so the behaviour cannot happen — regardless of how the conversation goes or what a stranger types into your website widget. The same rule holds for every tool on the platform: off means absent, not discouraged.

When the agent does hand over, it tells the customer it is doing so. The reasoning it wrote about why stays internal and never reaches them.

Takeover silences the agent

The moment a teammate sends a reply in the inbox, the agent stops answering that conversation. Two voices in one thread is the failure everybody has seen at least once — the customer asks a follow-up, the bot answers it before the human finishes typing, and the human now has to correct their own colleague.

Handling is read back out of the messages themselves rather than held as a separate switch somebody has to remember to flip, so it applies wherever the conversation continues — website widget, WhatsApp or Telegram.

Assignment is a different thing, on purpose

Takeover says a teammate has replied. Assignment says whose job a conversation is — a decision you can make before anybody has replied, and one that does not silence the agent. A thread can be assigned to somebody to watch while the agent keeps handling it.

Clearing the assignee is a real answer rather than a failure to give one: it puts the thread back in the pool, which is how a team hands work around. And the person you assign to is checked against the workspace's own member list on the server, so a conversation cannot be handed to somebody outside the workspace who would then see it in their queue.

What a person gets when they take over

• A live inbox. New messages arrive without a refresh, and the unread badge updates on every page of the console — not only while the inbox is open.
• Media both directions. Photos, video, audio and documents, up to WhatsApp's 16 MB ceiling on that channel.
• Saved replies. Text a teammate wrote once and sends often. The one placeholder is the customer's name, filled at the moment it is inserted. With no name on file the placeholder and the space around it are both dropped, so nobody sends "Hi , thanks for writing".
• Internal notes. Hidden from the customer. The agent's own escalation reasoning lands here too, so the person picking the thread up reads why before they type.
• The WhatsApp 24-hour window, stated in advance. Outside it the composer is replaced by an explanation instead of a text box, with a countdown through the final hour. Better to be told before writing a paragraph than after sending one that will not arrive.

How you find out a conversation needs you

• The notifications feed. "Conversations that need a person" is one of the things it carries, alongside failed webhooks, campaigns finishing, WhatsApp account health and template verdicts. This is the path for the majority of workspaces, who have wired neither a webhook nor a helpdesk.
• Signed outbound webhooks. Five event types, chosen per endpoint: a lead, an escalation, a resolution, a finished call and a finished campaign. Delivered to any HTTPS endpoint you control, signed so your side can verify who sent it. A webhook that fails five times in a row is switched off, and you are told that too.

Who is allowed to do it

A workspace has members with roles — owner, admin, member — plus invitations, role changes and removal. Tenant isolation is enforced twice over: row-level security for the console, and an explicit tenant filter in the runtime that answers customers, with automated assertions covering both.

What we deliberately did not build

There is no approval queue for individual tool calls, no priority badge, and no auto-approval timer. A timer that approves an action because nobody looked at it in twenty minutes is oversight in name only — it converts a human checkpoint into a delay.

Control over what the agent can do sits one level up instead. Every tool an agent discovers arrives switched off, enabling one is a deliberate act per tool, and an agent stops at eight enabled tools. You decide what is possible when you configure the agent, rather than deciding it again under time pressure in a queue.

There is also no agent that reviews another agent's work before it goes out. The reviewer is a person, or there is no reviewer.

Get started

Escalation triggers live in your agent's settings; the inbox is in the console sidebar. Set the triggers first, watch a week of handovers, then decide whether you want the third option — neither trigger, agent never escalates — for the agents where it genuinely does not apply.

Try the shared inbox free →

No credit card required • Trial includes 25 voice minutes and 200 chat replies