By default a thunk runs end to end on its own: a new request starts, each step begins, and each step finishes without waiting for anyone. Human approval gates let you insert checkpoints so a person signs off at the moments that matter — before work starts, before a step begins, or before a step is treated as done.
These are the Human-in-the-loop controls named in AI Governance. This article covers where to set each gate and what happens when one holds work for a person.
The moments you can gate
A workflow has three natural checkpoints, plus a final review on any individual step:
Gate | What it holds | When to use it |
Draft | A brand-new request, before the AI starts working on it | You want to look at or edit an incoming request before the workflow runs |
Start | Each step, before the AI begins it | A person should decide whether each step should run |
Complete | Each step, before it is treated as finished and the workflow advances | The AI's output needs a human check before the next step relies on it |
Finish (per step) | One specific step you choose | Most steps can run automatically, but one step (for example, sending an external email) needs sign-off |
Set gates for the whole thunk
Thunk-level gates apply to every step unless a step overrides them. (These settings call each workflow step a task.)
Open the thunk's Settings.
Select the Human-in-the-loop Manager section.
Toggle the gates you want:
Create new workflow requests in Draft mode — when on, the AI does not start working on a new request until someone approves it. Leave this on when you want to review incoming requests first.
AI starts work on new tasks without explicit user approval — when on (the default), the AI begins each step on its own. Turn it off to require approval before a step starts.
AI completes work on a task without explicit user approval — when on (the default), the AI decides when a step is done and the workflow advances. Turn it off to require a person to review and finish each step.
The same section also holds two related controls: Automatically re-assign new workflow tasks (the AI routes each step to the right person based on your instructions — see Users and access controls) and Escalate errors to owner, which alerts the thunk owner when the AI hits an error in testing or production.
Override a gate on a single step
You do not have to gate the whole workflow to add one checkpoint. Any workflow step can require a person even when the thunk runs automatically otherwise.
Open the step in the workflow plan.
Expand its Human-In-The-Loop Settings.
Turn on Require Human to review and finish step — the step's result is recorded, but a person must review and finish it before the workflow proceeds.
Step settings override the thunk default. A step that requires human review will pause for a person even when the thunk is set to complete steps automatically.
What a person sees when a gate holds work
When a gate pauses the workflow, the step waits for someone to act — it does not silently stop or fail. The AI records what it did (or its question), and a person can review the step chat and use Finish step when ready. For the full set of ways a step run ends — finish, wait, ask a question, or error — see How an AI agent ends a run.
To find every step across a thunk that is waiting on you, use the Waiting on me view.
Choosing where to add oversight
Start fully automated, then add a gate only where a mistake would be costly or hard to undo — an outbound message, a payment, a customer-facing document.
Prefer a single step override to a thunk-wide gate when only one action needs review. Gating every step slows the whole workflow and asks people to approve routine work.
Use Draft mode when the incoming request itself needs a look before anything runs, rather than gating each step after it starts.
Gating a step is a platform rule enforced no matter what the AI decides. For finish rules the AI should apply through its own judgment — for example, "do not finish until a reply arrives" — write that into the step's AI instructions instead. See How an AI agent ends a run for how instructions and platform gates work together.