An AI agent should ask a human for help when evidence is missing, instructions conflict, retries fail, the case falls outside known patterns, or the next action is sensitive, high-impact, or difficult to reverse.
A human handoff is not evidence that an AI agent failed.
It is evidence that the system knows where its authority ends.
The dangerous agent is not the one that asks for help. It is the one that keeps acting when the situation has moved beyond its evidence, permissions, or competence.
Define handoff triggers before launch
Write explicit triggers for the workflow.
Do not rely only on the model deciding whether it “feels uncertain”.
Use observable conditions.
Trigger 1: missing or conflicting evidence
Escalate when:
- A required field or document is absent.
- Two approved sources disagree.
- A source is out of date.
- A claim cannot be traced to evidence.
- The agent would need to guess a material fact.
The handoff should state exactly what is missing or conflicting.
Trigger 2: high-impact decisions
Require human approval for actions involving:
- Payments, refunds, credit, pricing, or financial commitments.
- Legal rights, contracts, disputes, or regulatory obligations.
- Employment, performance, access, or disciplinary decisions.
- Health, safety, or sensitive personal information.
- Public statements about identifiable people.
- Customer promises outside approved rules.
Australian cyber guidance on the careful adoption of agentic AI recommends incremental deployment, strict privilege controls, continuous monitoring, strong identity management, and human oversight.
Trigger 3: irreversible or difficult-to-reverse action
Pause before:
- Deleting records.
- Sending a message to a large audience.
- Publishing externally.
- Changing account permissions.
- Cancelling an order or service.
- Moving money.
- Applying changes across production systems.
Prefer actions that can be previewed, approved, and rolled back.
Trigger 4: repeated failure
Set a retry limit.
After a defined number of failed attempts, stop. Endless retries can create duplicate records, repeated messages, unexpected costs, or a confused audit trail.
The handoff should include:
- How many attempts were made.
- What changed between attempts.
- The last error.
- Whether any partial action succeeded.
Trigger 5: unusual or out-of-scope case
Escalate cases that differ materially from the examples used to design and test the system.
Examples include:
- A complaint inside a routine enquiry workflow.
- A vulnerable customer.
- A request involving a deceased person or legal representative.
- A supplier asking for access not covered by policy.
- A document type the workflow has never processed.
The model may still produce an answer. That does not make the case ordinary.
Trigger 6: suspicious instructions or inputs
An agent using email, documents, websites, or connected systems may encounter instructions written by an untrusted third party.
Escalate when content asks the agent to:
- Ignore its rules.
- Reveal hidden instructions or data.
- Use a new destination or account.
- Download or run unknown material.
- Expand its permissions.
- Bypass review.
These may be signs of prompt injection or social engineering.
Make the handoff useful
A person should not receive a vague alert saying “AI needs help.”
Provide:
- The task and intended outcome.
- The relevant source evidence.
- Actions already taken.
- The trigger that caused the stop.
- Any changes already made.
- The risk or uncertainty.
- The exact decision required.
Good handoffs reduce interruption and help people act quickly.
Route to the right person
The nearest available person is not always the right reviewer.
Map handoffs by issue:
- Workflow owner for missing process information.
- Manager for commercial commitments.
- Privacy or security lead for data issues.
- Qualified adviser for legal, medical, financial, or regulated matters.
- Technical owner for integration or permission failures.
Also define response times and what happens if nobody responds.
Learn from handoffs
Review handoff logs monthly.
Look for:
- Repeated missing information.
- Instructions that need clarification.
- Cases that should become a new approved path.
- Permissions that are too broad or too narrow.
- Tasks the agent should no longer attempt.
Do not automatically eliminate every handoff. Some are permanent safety boundaries.
OpenAI’s agent guide identifies failure thresholds and high-risk actions as important triggers for human intervention. The principle is simple: autonomy should expand only where evidence shows it is safe and worthwhile.
First understand the difference between agents, workflows, and automation. Then use AI workflow testing to prove that the handoffs work. Rising Tide can map these controls as part of an AI assessment.