Human-in-the-loop (HITL) checkpoints

Business Summary: Human-in-the-loop (HITL) checkpoints let you pause agents at the right moments — for clarification, draft review, or high-risk writes — so AI work stays fast without skipping accountability.

Human-in-the-loop checkpoints on the collaboration rail

Human-in-the-loop (HITL) means the agent stops and waits for a person to review before continuing or releasing sensitive results — by design, not as an error. You choose how strict those pauses are when you scope a workstream, and agent governance triggers can tighten defaults for specialist teams that handle regulated or high-spend work.

Note: Header notifications and HITL dropdown items currently show sample data in some web builds. Governed HITL inside workstream chat is partial — full checkpoint flows may appear in the desktop app first. See .

Respond to a checkpoint

Open the workstream flagged on Overview Awaiting Approval or from a Process Board run row with an HITL badge.
Locate the collaboration rail on the workstream workspace — click HITL review when the badge shows pending items.
Read the checkpoint card in chat or the rail panel — note tier: Soft (clarification), Hard (draft review), or Critical (external write or high spend).
For Soft HITL, answer the clarifying question directly in chat — the run usually continues without a full stop.
For Hard HITL, review the draft output preview — approve, request changes, or reject using the panel actions.
For Critical HITL, verify the preview of downstream actions — planned connector writes, ERP updates, or spend — before signing off.
Confirm only admins approve Critical writes to downstream systems when policy requires — managers may review but not publish.
After sign-off, verify the event in Audit & History with your name as Actor.
Return to Process Board — the HITL badge clears when the checkpoint resolves.

Set HITL when scoping a workstream

During New workstream Perception wizard, choose an HITL preset: Standard, Strict, or Custom — see presets table below.
Add approvers via Add collaborators… — Strict presets may require two distinct approvers for Critical gates.
In Plan mode, enable Require output review (HITL) on the Confirm & run card for run-level Hard gates.
Set the workstream's approval gates when you create it. Stricter presets pause more often before a write or a published output.
Avoid disabling the HITL master toggle in workstream settings for production connector writes.

HITL is the mechanism that connects agent execution to your approval workflow. Every governed run passes through preset tiers; when a gate fires, Nimbus surfaces a checkpoint in chat and on Overview until an approver signs off.

Each tier is a gate type that can fire at different points in a run — a single run may hit Soft clarification, then Hard draft review, then Critical write approval. The diagram shows parallel paths, not a mandatory sequence through all three.

flowchart TB
  Run[Agent run]

  Run --> Soft[Soft HITL clarifying question]
  Run --> Hard[Hard HITL draft review]
  Run --> Crit[Critical HITL write or spend gate]

  Soft -->|Answer in chat| Run
  Hard --> Sign[Sign-off]
  Crit --> Sign
  Sign --> Resume[Run continues or commits]

Cross-reference Checkpoints and approvals for UI locations (Needs you, Sign-off) and Sign-off and approval flow for release mechanics.

Three checkpoint tiers

Tier	Purpose	Blocks run?
Soft HITL	Clarification, missing data, low confidence	Usually no — questions in chat
Hard HITL	Draft output review before publish	Yes
Critical HITL	External writes, dual approvers, high spend	Yes

Soft HITL keeps momentum while surfacing uncertainty. Hard and Critical are hard stops until sign-off.

Checkpoint state flow

stateDiagram-v2
  [*] --> Running
  Running --> SoftAsk: Soft HITL question
  SoftAsk --> Running: User answers in chat
  Running --> NeedsYou: Hard or Critical gate
  NeedsYou --> Approved: Sign-off approve
  NeedsYou --> Changes: Request changes
  Changes --> Running: Agent revises
  NeedsYou --> Rejected: Reject
  Approved --> Running: Continue or commit
  Rejected --> [*]
  Running --> CritGate: Critical write preview
  CritGate --> NeedsYou: Awaiting admin sign-off

Preview before downstream action

When HITL is enabled on a workstream, Nimbus gates not only reports but also agentic decisions and writes back through action connectors. Before any external change executes, approvers see a preview of what will happen — the planned writes, updates, or actions — and can approve, reject, or request changes. After approval, committed work traces in Audit & History and the Lifecycle Graph.

Roadmap: Review on Live Canvas before downstream Actions ungate is planned — use workstream Outputs and HITL cards in chat today. See Collaboration overview.

HITL presets

When scoping a workstream, choose a preset:

Preset	Approvers	Typical gates
Standard	1	Output review; external writes when connectors allow
Strict	2	Adds spend threshold enforcement
Custom	Configurable	Mix output review, writes, spend, adaptive clarification

Adaptive clarification (Soft HITL) can stay enabled when other gates are relaxed.

Confirm & run interaction

Plan mode Confirm & run includes Require output review (HITL) — a run-level toggle aligned with Hard gates. Critical connector writes still require separate Critical approval even if output review is off (when policy requires). See .

Example scenarios

FP&A lead — Strict preset on quarterly close

An FP&A lead scopes a quarterly close workstream with Strict HITL and adds the controller as second approver. The agent drafts a variance report — Hard checkpoint; she signs off alone. A separate run proposes journal entries to the ERP — Critical checkpoint; controller and FP&A lead both sign off after reviewing the write preview. Soft HITL fires once when the agent asks which subsidiary mapping to use; she answers in chat and the run continues without a full stop. Events appear in audit with both Actor names.

RevOps manager — Critical Slack write after report approval

A RevOps manager completes a Plan run with Require output review enabled. After Hard approval, she switches to Action mode: Post the approved summary to the configured Slack channel. Critical HITL gates the downstream write — an admin approves; the message lands only in the configured #revops-alerts channel. She verifies the connector write in Audit & History and the team's HITL column increment on Browsing Teams.

What you'll see

What you'll see: Interrupt cards in chat, Overview Pending approvals, checkpoint panels with approve / request changes / reject actions, HITL review on the collaboration rail, and HITL badges on Process Board run rows.

FAQs {#faqs}

Q: What's the difference between HITL and governance? A: HITL is the mechanism (checkpoints). Governance is the broader policy layer including NTU budgets and export rules — see What is governance in Nimbus?.

Q: Can guests approve checkpoints? A: Generally no — guest org tier cannot approve Critical writes. See Org access tiers.

Q: Does Analyze mode trigger Hard HITL? A: Rarely, unless policy requires review for all artifacts. Plan mode formal reports typically do.

Q: How many approvers for Strict? A: Two distinct approvers for configured Critical gates, especially spend and dual-write scenarios.

Q: Where does approval history go? A: Workstream Activity, Audit & History, and Lifecycle Graph via View Lineage.

Q: Can I change HITL after the workstream is created? A: Yes. Workstream owners adjust presets in settings; stricter gates apply to new runs going forward.

Q: Who can approve Critical connector writes? A: Only org admins approve Critical writes to downstream systems. Managers (org members without admin tier) can run Action mode and review drafts, but external publishes wait in HITL review until an admin signs off.

Q: Does HITL apply on Live Canvas? A: Report commitment may require approver sign-off before operating memory updates; full Live Canvas HITL integration is on the roadmap — use Outputs and chat checkpoints today.

What to do next

Learn sign-off mechanics → Sign-off and approval flow
Configure presets when scoping → Checkpoints and approvals
Review approval history → Audit and History page